Redirect to a time-limited signed URL for downloading an attachment. Returns HTTP 302 with a Location header pointing at a short-lived S3 URL. The URL expires after a short period and must not be cached.