refactor(cdn): remove ACL parameter from S3 uploads, rely on bucket policy instead

[sgore-godaddy]

Summary

This change removes the object-level ACL parameter from S3 putObject calls, eliminating the need for the s3:PutObjectAcl IAM permission.

Motivation

Object-level ACLs are being phased out in favor of bucket policies as an AWS best practice. By removing the ACL: 'public-read' parameter, we can tighten IAM permissions and manage public access centrally through bucket policy instead.

Changelog

• Removed ACL parameter from uploadFileToStorage function
• Removed unused DEFAULT_ACL constant
• Public read access is now controlled via bucket policy rather than per-object ACLs

Test Plan