Add strict signature validation of aws-chunked streams

[vagaerg]

Closes #102

Ensure we never return x-amz-decoded-content-length bytes without having verified the signatures.

This should protect us from:

• Chunks overreporting their size so that we send x-amz-decoded-content-length before validating the signature (as the proxy did not know the chunk had finished)
• Chunks containing more data than they report
• Mismatched declared and actual content lengths