feat: add media route with media bus upload

[kptdobe]

With https://github.com/adobe/helix-admin/pull/3292, we can now directly upload to the media bus.

This PR creates the /media route in da-admin:

• checks if user is allowed to write on the given key
• if yes, uploads the provided media to the aem media bus
• simply forwards the response that contains the uri of the uploaded resource

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[auniverseaway]

I would prefer we push this feature to Helix6 / DA2.

I don't think we should make a dedicated media route. While this doesn't have to be used by developers, I think it creates a weird scenario where a media file can be handled two different ways. I would prefer we don't have more than one way to do an operation.

This also creates a scenario where if you upload to DA, you think your media is private, but it's no longer private [1]. I get that it would be nearly impossible to guess a hash, we are still changing our commitment to customers that the content they upload to DA is private. If it goes into Media Bus, it's public.

We have also historically resisted being a proxy around Helix Admin APIs. The only thing this buys us is that if someone is authenticated with us, they get a direct path to upload to Media Bus. We could easily make the leap to, "you must be at least a basic_author on your site to upload and then we can use Helix APIs via the client.

Because we become a thin proxy around Media Bus, there's also now an extra hop in requests... client > da admin > hlx admin. Even if tiny, this will make requests slower.

The root problem we are trying to solve is:
"As an author, if I move a page, I do not want my drag and drop references to be broken on move."

What I like about this solution is:

References will no longer break.
Images go right to media bus reducing duplication.
We get in front of media that will not go out the door on Edge Delivery (vs. finding out on preview)
If we zoom back, we can accomplish the references breaking issue by changing the default location to something that is more permanent (/media/my-path/to/page/name-of-image.jpg) rather than introducing an entirely new API route that is a thin proxy around Media Bus.

When we get to Helix6 / DA2, we can take a better stab at merging these two worlds so that images in DA are done in a consistent way that still satisfies our larger goals around de-duplication, etc.

[1] Yes, I'm aware.