fix: address missing bucket in policy condition

[frankyn]

This prevents the possibility of changing the bucket name after the policy is signed allowing bad actors to upload to a different bucket that it was originally intended to.

Pending review with @ranylee.

1. Test Example
2. bucket name: rsaposttest-1579902670-h3q7wvodjor6bc7y

Before change

{"conditions":[{"key":"test-object"},{"x-goog-date":"20200123T043530Z"},{"x-goog-credential":"test-iam-credentials@dummy-project-id.iam.gserviceaccount.com/20200123/auto/storage/goog4_request"},{"x-goog-algorithm":"GOOG4-RSA-SHA256"}],"expiration":"2020-01-23T04:35:40Z"}

Change is to introduce bucket name as an additional condition in the Signed Policy. No additional field is outputted.

{"conditions":[{"bucket":"rsaposttest-1579902670-h3q7wvodjor6bc7y"},{"key":"test-object"},{"x-goog-date":"20200123T043530Z"},{"x-goog-credential":"test-iam-credentials@dummy-project-id.iam.gserviceaccount.com/20200123/auto/storage/goog4_request"},{"x-goog-algorithm":"GOOG4-RSA-SHA256"}],"expiration":"2020-01-23T04:35:40Z"}

[quartzmo]

All unit and acceptance tests passing in google-cloud-ruby with this change:

google-cloud-storage % git diff
diff --git a/google-cloud-storage/lib/google/cloud/storage/file/signer_v4.rb b/google-cloud-storage/lib/google/cloud/storage/file/signer_v4.rb
index 69a6242f6d..72af381a46 100644
--- a/google-cloud-storage/lib/google/cloud/storage/file/signer_v4.rb
+++ b/google-cloud-storage/lib/google/cloud/storage/file/signer_v4.rb
@@ -164,6 +164,7 @@ module Google
 
           def required_fields issuer, time
             {
+              "bucket" => @bucket_name,
               "key" => @file_name,
               "x-goog-date" => time.strftime("%Y%m%dT%H%M%SZ"),
               "x-goog-credential" => "#{issuer}/#{time.strftime '%Y%m%d'}/auto/storage/goog4_request",

[frankyn]

Perfect, thanks for confirming @quartzmo!