ACL flag for S3 uploads

This adds a `publicReadAcl` flag to tasks involving an S3 upload. By default it is `true`, to preserve the existing behaviour of giving the public canned ACL to S3 objects.

Ideally we should make the default `false` ASAP.

This affects a number of deploy types, but I have only tested this fully with an autoscaling deploy.