Retrieve / delete single upload via REST API using secret and filename

From #25838 (comment 2059563910).

In !157066 (merged), we added endpoints to manage uploads but this is for Maintainers enumerating downloads.

When you have an upload URL in Markdown, you can fetch the download if you have an authenticated session. But there is currently no way to download this with an API token.