Unauthenticated endpoint that returns viewer assets for a published
package or a published dataset, along with a CloudFront signed policy
for accessing the asset files. Each asset includes an asset_url.
To access files, append the relative path and signing params:
{asset_url}{path}?Policy={policy}&Signature={signature}&Key-Pair-Id={key_pair_id}

Caller must supply exactly one of package_id or dataset_id.
Note the asymmetry between the two: the package side accepts a node ID
because discover.public_file_versions stores source_package_id as a
node ID, while the dataset side accepts the published-dataset integer
PK because discover.public_datasets does not record the source
dataset node ID.