A developer needs to generate a shared access signature (SAS) that grants a partner application temporary access to only a single blob container in your storage account. The SAS must NOT allow access to file shares, queues, or table services, and it should not require access to management operations like creating new containers. Which type of SAS should you generate?