🐛 Strip Authorization header when proxying asset redirects to S3 (#10777)

When nginx follows a backend 307 redirect to a presigned S3 URL, it was
forwarding the client's Authorization header to S3. Production S3 rejects
this because it sees two auth mechanisms (presigned URL signature +
Authorization header). MinIO in devenv is more lenient and ignores the
extra header.

Fix: add proxy_set_header Authorization "" in the @handle_redirect block.

Fixes #10776

AI-assisted-by: mimo-v2.5-pro

docker/devenv/files/nginx.conf

@@ -86,6 +86,7 @@ http {
             set $real_mtype "$upstream_http_x_mtype";
 
             proxy_set_header Host "$redirect_host";
+            proxy_set_header Authorization "";
             proxy_hide_header etag;
             proxy_hide_header x-amz-id-2;
             proxy_hide_header x-amz-request-id;

docker/images/files/nginx.conf.template

@@ -94,6 +94,7 @@ http {
             proxy_buffering off;
 
             proxy_set_header Host "$redirect_host";
+            proxy_set_header Authorization "";
             proxy_hide_header etag;
             proxy_hide_header x-amz-id-2;
             proxy_hide_header x-amz-request-id;