ACL flag for S3 uploads

This is for those of us who do not wish to rely on security through obscurity.

This adds a `publicAcl` flag to tasks involving an S3 upload. By default it is `true`, to preserve the existing behaviour of giving the public canned ACL to S3 objects.

Ideally we should make the default `false` ASAP.

This affects a number of deploy types, but I have only tested this fully with an autoscaling deploy.