Remote code execution by hijacking an unclaimed S3 bucket in Rocket.Chat's installation script.

When I downloaded the latest release of Rocket.Chat to test the fix for my previous report I spotted an `install.sh` script. Inside that installation script I noticed [the following line](https://github.com/RocketChat/Rocket.Chat/blob/develop/install.sh#L14):

#!/bin/bash
set -x
set -euvo pipefail
IFS=$'\n\t'

ROOTPATH=/var/www/rocket.chat
PM2FILE=pm2.json
if [ "$1" == "development" ]; then
  ROOTPATH=/var/www/rocket.chat.dev
  PM2FILE=pm2.dev.json
fi

cd $ROOTPATH
+ curl -fSL "https://s3.amazonaws.com/rocketchatbuild/rocket.chat-develop.tgz" -o …