Policy enforcement in file and blob creation

[zachmullen]

Policies we to enforce around uploading:

• The size of the blob that is attached to a file matches the declared size of the file.
• File size values are immutable, at least via REST.
• The blob field of a file is immutable. It can be changed from no file to having a file, but not from one file to another.
• Blobs can only be uploaded if they correspond to a pre-initialized file. This will need changes in both S3FF and this repository. See Support arbitrary policy enforcement in REST endpoints kitware-resonant/django-s3-file-field#204

[mgrauer]

Security focused follow up to #124.

[zachmullen]

Third checkbox here is met by #166