feat: would like patch urls to be unpredictable

[eseidel]

Patches are stored publicly (they have to be in order for apps to download them, since it's not possible to have anything secret stored within an apk). We've disabled listing of the relevant buckets, but it still might be possible to guess (or remember) patch urls and (re-)download them. A customer asked this morning if we could obfuscate patch urls (e.g. make them unpredictable and potentially even per-request/expiring). Should be easy to do.