redirect AWS client blob requests to s3 based on client IP -> AWS region

[BenTheElder]

builds on #42, depends on #46
~fixes #39

Implements:

• given an HTTP request, get the client IP (either locally in development, or in cloud run from GCLB)
• map IP request to AWS region
• if not an AWS client, redirect to primary registry
• if an AWS client, redirect to a bucket copy based on the region

Also clarifies that cmd/archeio is not engineered to be reusable at this time, instead the reusable bits are implemented as library packages (like the CIDR matching, IP to AWS region matching).
We can greatly simplify runtime concerns and reliability by keeping it this way for now.
In the future it's possible we'll be using an entirely different approach (CDN?) anyhow.

Needs cleanup, tests, and a feature gate of some sort (disabled by default, we're not ready to roll this out yet), but it's there.

Right now all regions are mapped to the single bucket we have.
We can use that to test in CI in the sandbox, but before enabling in production we will need to replace with our real bucket mapping.

[BenTheElder]

moved some of this to #48

[BenTheElder]

tests still need work, will get back to this in the morning.

[BenTheElder]

I'll have some more unit tests / cleanup committed later this morning and then this should be ready for reviews.

[BenTheElder]

Probably should feature-gate this in some fashion, but it's otherwise done.

[BenTheElder]

I think we can do that in a follow-up, this is pretty large as-is.

[dims]

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BenTheElder, dims

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [BenTheElder,dims]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment