[web] Pass CSAT to Blob service when fetching multimedia

Summary:
Same as D10910 but for web - modified fetchAndDecryptMedia() to accept auth metadata.

Depends on D10910

Test Plan: Repeated test plan from D10910, but on web.

Reviewers: atul, tomek, inka, michal

Reviewed By: tomek

Subscribers: ashoat

Differential Revision: https://phab.comm.dev/D10912