expose files/:id/public_url in API and use it

fixes CNVS-13156

when requesting the public_url for an attachment for use in preview, do
so through an official API endpoint so that it doesn't get redirected to
a different domain if the file was originally from a root account with a
different domain. this redirect would cause problems due to cross-origin
resource sharing since the request is XHR.

document the now-official endpoint while we're at it.

test-plan:
 - have two root accounts, A and B, with different domains
 - create a course in root account A
 - upload a pdf to that course's files
 - go to the course settings and move the course to root account B
 - visit the course's files page using root account B's domain
 - click the pdf in the left file listing pane, so it attempts to
   preview in the right pane
 - should not get an XHR error about a cross-domain request

Change-Id: Ie126dbea558b9d329bee8e86389f9340515a2394
Reviewed-on: https://gerrit.instructure.com/35493
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Nick Cloward <ncloward@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Brian Palmer <brianp@instructure.com>