Use s3 URLs if not public

[matthewhanson]

If assets are public the hrefs should be http URLs. If they are not public they should be s3 URLs. This follows STAC best practices.

Same goes for the canonical URLs of the STAC objects.