Delegate S3 file validation endpoint

[dantb]

Opening as a draft to check this fits the requirements for #4889 - it wasn't clear which validation steps were necessary and hard to ask without referencing code. I'll add integration tests afterwards for the full validation / file creation journey. Some comments in line