Arvados

• Pretty similar to #21901
• Define a cachedS3Secret struct

  type cachedS3Secret struct {
          secret string
          expiry time.Time
  }

• Add a map[string]cachedS3Secret to handler
• Expiry time should be earlier of aca.ExpiresAt (assuming !aca.ExpiresAt.IsZero()) and time.Now().Add(h.Cluster.Collections.WebDAVCache.TTL.Duration())

• yes, caching the entire APIClientAuthorization object LGTM
• checks3signature() needs to acquire h.s3secretCacheMtx.Lock() before doing the h.s3SecretCache[unescapedKey] lookup
• NewCachedS3Secret should be unexported (i.e., newCachedS3Secret)
  • less critical: IsValidAt should be isValidAt (since the struct itself isn't exported the method is effectively private anyway, but in general methods like this can end up being called by other modules by virtue of satisfying an interface, so if that's not intended, I'd default to an unexported name)
• maybe rename s3SecretCacheTidyDuration to s3SecretCacheTidyInterval?
• it looks like checks3signature() doesn't write to aca, so it would be safe to make aca a pointer instead of a value, and avoid the extra copy when using a cached auth. That's a pretty tiny optimization, though, so leaving it alone would also be fine with me.

I had to rebase because I noticed the commit message had the wrong ticket number. 9e21b7cdd3e51afd02acdb8b2989dbe949da2680 is identical to what you reviewed before except for that edit to the commit message.

Everything you suggested sounds good to me. Made those changes and now at 24f9b12ff94f2725e4b797f92738ebd2e2b96852 - developer-run-tests: #4351

LGTM, thanks!