feat(artifacts): add get_authenticated_url and get_signed_url to GcsArtifactService

[patil-prajwal]

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

Problem:
Currently, GcsArtifactService.get_artifact_version() only returns canonical_uri in gs://<bucket>/<blob_name> format. While gs:// URIs work seamlessly when passing file references directly to Vertex AI / Gemini API models (types.FileData(file_uri="gs://...")), web applications, chat frontends, and external API consumers cannot access gs:// links directly in a browser.

Developers are currently forced to manually perform fragile string replacements (e.g. .replace("gs://", "https://storage.cloud.google.com/...")) or reach into internal Cloud Storage client objects (self.bucket.blob(...)) to generate accessible URLs.

Solution:
Add two dedicated, async-compatible methods to GcsArtifactService:

1. get_authenticated_url() (and _get_authenticated_url_sync()):

   • Generates the standard Google Cloud Storage authenticated browser URL (https://storage.cloud.google.com/{bucket_name}/{blob_name}).
   • Requires Google login with IAM read permissions.
   • Requires zero signing credentials or private keys, has no expiration (no TTL), and constructs deterministically.
   • Resolves the latest version automatically when version=None. Returns None if the artifact does not exist.

2. get_signed_url() (and _get_signed_url_sync()):

   • Generates a time-limited signed download URL via Blob.generate_signed_url().
   • Supports custom expiration (timedelta, datetime, or integer seconds; defaults to 1 hour), HTTP method, and forwards extra keyword arguments.
   • Ideal for public end-users and client downloads without Google accounts.
   • Resolves the latest version automatically when version=None. Returns None if the artifact does not exist.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

Summary of passed pytest results:

• test_gcs_get_authenticated_url_latest_version — PASSED
• test_gcs_get_authenticated_url_specific_version — PASSED
• test_gcs_get_authenticated_url_returns_none_for_missing — PASSED
• test_gcs_get_signed_url_latest_version — PASSED
• test_gcs_get_signed_url_returns_none_for_missing — PASSED

Manual End-to-End (E2E) Tests:
Verified end-to-end URL resolution using mock GCS storage:

• get_authenticated_url correctly resolves the latest version and returns https://storage.cloud.google.com/test_bucket/app/user1/sess1/notes.txt/1.
• get_signed_url correctly forwards expiration and method to generate time-limited signed URLs.
• Both methods return None when the requested artifact does not exist.

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have signed the Google Contributor License Agreement (CLA).

Additional context

The canonical_uri field on ArtifactVersion is left untouched (gs://...) so backend model ingestion flows (SaveFilesAsArtifactsPlugin, Gemini multimodal file references) remain 100% backward-compatible.