Sign the file of one asset linked to an answer request

A time-limited download URL for the file behind one asset of the company a questionnaire request is about. Readable by all three parties to the request; anyone else gets 404 request_not_found. Takes an asset id, never a file url: the object key is resolved server-side from an asset that belongs to the request's subject company, so a valid requestId cannot be used to sign a file of some other company's asset. That is the whole difference from GET /v3/files/:fileUrl, which signs any private-bucket key it is handed. An asset the subject company does not hold answers 404 asset_not_found; a real asset carrying no file answers 404 asset_has_no_file, which is a different thing and says so. part picks between an audit's two files — its report (the default) and its corrective action plan — since the answer form previews both; the other buckets ignore it.