fix: don't send authorization headers with download links

[mguida22]

Changelog

Fix: authorization headers are no longer sent on requests to download links.

Docs

None

Description

Our download links use signed object store URLs. They don't need and shouldn't be sent auth headers that we use to communicate with the regular Foxglove API. This prevents sending headers by using a regular request for our download requests instead of our existing __session.

As part of this change I noticed it's possible for streaming responses to not properly close on error. This ensures we always close the response in a finally block.

In addition to tests here, I've tested that downloads still work properly via a local test script against our real backend.

[claude]

One open risk before release: smoke-test the signed-URL paths — /v1/data/stream, /v1/data/upload, and the attachment redirect target — against a real backend. The whole change rests on those links needing no Authorization; if any still expects the Foxglove token, downloads/uploads will start 401ing once auth is stripped. Not verifiable from the diff.