Signed URLs with a custom asset_host are signed over the wrong canonical resource

[petermueller]

Problem

When a custom asset_host is configured, UrlV2.build_path/2 omits the bucket from the path:

defp build_path(definition, path) do
  path =
    if endpoint() != @endpoint do
      path                              # <-- no bucket segment
    else
      bucket_and_path(definition, path)
    end
  ...

The v2 signing canonical resource must be /<bucket>/<object>. With an asset host set, the string that gets signed is /uploads/x.png instead of /my-bucket/uploads/x.png, so the signature can never validate. On top of that, the GoogleAccessId/Expires/Signature query parameters get appended to a CDN hostname that won't honor them.

Net: signed: true + asset_host yields URLs that always fail, silently constructed.

Proposal

Short term (v0.3): when a signed URL is requested and an asset host is set, either sign against the real storage.googleapis.com/<bucket>/<object> resource and emit that URL (ignoring the asset host, documented), or raise with a clear message that the combination is unsupported. Either beats emitting a URL that can't work.

Long term: the v4 signer (#14) should define explicit CDN/custom-domain semantics.

Related: #14 (v4 signing), #16 (signed URLs require legacy Goth config), #18 (signed URL errors with service accounts).

Affects both v0.2.x and main. Part of the v0.3 release plan (plans/0.3-release.md).