[MRG] Fix S3 file download failing with 403 SignatureDoesNotMatch

[chiku-samugari]

Summary

Added safe redirect handling for S3 in streaming methods to avoid forwarding specific headers that break presigned URL signatures.

Background

OSFSession attaches default headers including Content-Type and Accept to every request. However, the WaterButler S3 provider does not include these headers when generating presigned URLs. When the rdmclient follows a redirect to a presigned URL while forwarding those extra headers, the signature no longer matches and S3 returns 403 SignatureDoesNotMatch.

Changed

When a streaming request is redirected to a presigned URL, this change forwards only the headers that are expected/covered by the presigning process, and avoids forwarding specific headers that invalidates the signature.

Scope

This affects only GET requests that follow redirects to presigned URLs returned by the corresponding WaterButler providers. Currently relevant providers include:

• S3
• Azure Blob Storage
• Figshare