Use collision-resistant filenames for uploads

Use [cuid](https://github.com/ericelliott/cuid) to generate a filename suffix, instead of iteratively checking names against S3.

`cuid.slug()` should be more than collision-resistant enough for our needs. In the field, we will typically have one fewer S3 query. In our tests, we save many extra queries, which were slowing down a couple of test cases.

With a horizontally scalable system, checking S3 actually did not guarantee a lack of collisions, since two dynos could receive uploads at about the same time. For instance, if an app comes out of offline mode and has two entries for the same base feature, it might submit those in quick succession, and two separate dynos could process uploads, see 404s from S3, and use the same name. S3 does not prevent overwrites, since it faces the same coordination challenge of distributed systems. Even with `cuid.slug()`, we should be extremely safe.

/cc @hampelm