Take a signed permanent reference for a blob and turn it into an expiring service URL for download.

WARNING: All Active Storage controllers are publicly accessible by default. The generated URLs are hard to guess, but permanent by design. If your files require a higher level of protection consider implementing Authenticated Controllers.