Earth Search returns raw s3://bucket/key hrefs for cop-dem-glo-30 (and a
handful of other collections), which fail with reqwest "builder error" because
the s3 scheme isn't handled directly. Add a small normalize_url() helper in
crates/cloud/src/http.rs that rewrites s3://bucket/key → https://bucket.s3
.amazonaws.com/key before building the request. reqwest follows the 307
redirect to the regional endpoint automatically, so no region config is
needed.

Call it at the HEAD and fetch_range entry points (the only code paths that
touch COG URLs; STAC search itself already uses HTTPS). Other schemes pass
through unchanged.

Unit tests for the three cases: s3 → https, https pass-through (verifies no
allocation), malformed s3://bucket without key (leaves as-is so reqwest
emits a clearer error).

Verified end-to-end: surtgis stac fetch-mosaic --collection cop-dem-glo-30
on the default --catalog es now completes (previously bailed with "No tiles
were successfully fetched" after hitting the builder error on every item).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>