Returns a short-lived presigned URL that the caller can PUT a file to,
along with the canonical downloadUrl to reference once uploaded.

Pass the returned downloadUrl as attachments[].url on any endpoint
that accepts an attachments array — currently POST /tickets/{id}/messages
and POST /timeline_comments. Both consumers use the same shape:
{ url, name, contentType, sizeBytes }.

The caller must hold at least one write scope for a surface that
consumes attachments (write:tickets or write:customers).

The signed URL is valid for one hour. After that the upload must be
re-requested.