[ActiveStorage] Disallow S3 access unless in production

[garyhtou]

Previously, when running HCB in Rails development but using production credentials, there was a possibility of interacting with production's S3 bucket (e.g. deleting images).

Rails recommends using Rails.env in the bucket name, however, it's too late for us to do that.

still needs to be tested