Provide signed url for uploaded expense files

[hdiniz]

Related opencollective/opencollective#6351

[Betree]

Since it's serving a critical feature with sensitive permissions, we need to add proper tests for the /files/... controller.

[Betree]

I'm not sure if classes are scoped in our email setup (we're using juice to inline CSS). If not, maybe use something that is less likely to clash (e.g. expense-item-preview)

[hdiniz]

Thanks for your review on this @Betree, I have made changes according to our discussion so far, but its still not complete.
One missing piece here is a strategy for dealing with uploaded files used in expense invites, I will look into it next.

[Betree]

Great job with the draft status handling 👍

Looking good overall, I expressed some concerns below but they're non-blocking. Let's try to deploy & test this in production before the holidays.