Support CloudFront OAC for S3 origins

[droguljic]

For now, CloudFront only supports S3 buckets configured as the website endpoint. This comes with few limitations:

• S3 bucket must be public.
• Communication between CloudFront and S3 is only possible over HTTP.
• S3 must be configured as a custom origin.
• Origin Access Control (OAC) is not supported.

Supporting OAC implies increased security and allow use of private buckets which are configured as true S3 origins within CloudFront distribution.