[hma] Ability to fetch media from S3-compatible storage

[ThisIsMissEm]

Currently when you want to work with media stored on an S3-compatible storage solution (AWS S3, DigitalOcean Spaces, Minio, etc), you need to either use presigned URLs and use the GET /h/hash endpoint, or you need to have a intermediary process first download the file from media storage and then send it to HMA via FormData / multipart request (POST /h/hash)

It'd be very useful to be able to configure HMA with credentials for a bucket and then pass a payload to HMA saying "fetch this object key from this bucket and hash it", so the API might look something like a JSON POST /h/hash with:

{
  "bucket": "example-media",
  "key": "/path/to/media/file.png"
}

This could also support doing a POST request for url based hashing too:

{
  "url": "https://some.url.example/path/to/media/file.png"
}

(potentially worth including an expires_at timestamp, such that HMA can quickly assert if the URL is still valid, in the case of queue-based hashing, instead of request-based)

[Dcallies]

I like this idea, since S3 is likely going to be common.

Is there a library we can use (boto3?) to help with configuration management?

[ThisIsMissEm]

Yeah, I think Boto3 is the go-to package for interfacing with S3 compatible object storage in python. It can read directly from environment variables. I'm not sure whether we'd need to just support a single credential (e.g., one credential that may access one or more buckets) or whether we'd need a way to provide configuration for specific buckets (more complicated)