Authorize explicit object version deletes

[metaneutrons]

What changed

• authorize DELETE requests without versionId using s3:DeleteObject
• authorize DELETE requests with an explicit version, including versionId=null, using s3:DeleteObjectVersion
• select the action independently for each entry in multi-delete requests
• preserve the effective per-entry s3:versionid condition value
• remove the obsolete compatibility check that still required DeleteObject for explicit versions

Why

Silo previously required s3:DeleteObject for every delete and treated s3:DeleteObjectVersion only as an additional deny check. This prevented a least-privilege principal from deleting exact immutable versions without also gaining permission to delete the current key or create delete markers.

The new mapping follows AWS S3 authorization semantics and keeps current-object and exact-version deletion independently grantable.

Closes #58.

Compatibility

This is an authorization change, not an S3 API or storage-format change. Policies that intentionally allowed explicit version deletes with only s3:DeleteObject must grant s3:DeleteObjectVersion instead. Current-object deletes continue to require s3:DeleteObject.

Validation

• focused authorization suite, repeated 10 times
• focused race-detector suite
• complete go test ./cmd -count=1
• go vet ./cmd
• CGO_ENABLED=0 go build ./...
• make verifiers with the module-pinned stringer and msgp generators
• govulncheck ./cmd: no called vulnerabilities

Regression coverage includes signed IAM identity policies and anonymous bucket policies; single and multi-delete; UUID, null, and delete-marker versions; inverse permission boundaries; per-entry action and s3:versionid selection; explicit deny precedence; denied-data preservation; and preservation of the object version beneath an explicitly deleted marker.

Reference

• AWS S3 required permissions for API operations: DeleteObject without versionId requires s3:DeleteObject; a specific version requires s3:DeleteObjectVersion.
• AWS S3 DeleteObjects API: multi-delete authorization depends on whether each entry supplies a version ID.

[Vonng]

Thank you for the contribution and for establishing the correct AWS action split.

The release implementation has now landed through PR #104, which independently incorporates the same core mapping and extends it across multi-delete context preservation, null/malformed IDs, condition values, explicit denies, delete markers, audit context, and least-privilege replication tests. PR #104 merged as 0a9c77779.

This draft is now conflicting with main and is superseded by the merged implementation, so I am closing it without merging.