S3: Enforce bucket policy (#7471)

* evaluate policies during authorization

* cache bucket policy

* refactor

* matching with regex special characters

* Case Sensitivity, pattern cache, Dead Code Removal

* Fixed Typo, Restored []string Case, Added Cache Size Limit

* hook up with policy engine

* remove old implementation

* action mapping

* validate

* if not specified, fall through to IAM checks

* fmt

* Fail-close on policy evaluation errors

* Explicit `Allow` bypasses IAM checks

* fix error message

* arn:seaweed => arn:aws

* remove legacy support

* fix tests

* Clean up bucket policy after this test

* fix for tests

* address comments

* security fixes

* fix tests

* temp comment out

test/s3/iam/README.md

@@ -257,7 +257,7 @@ Add policies to `test_config.json`:
         {
           "Effect": "Allow",
           "Action": ["s3:GetObject"],
-          "Resource": ["arn:seaweed:s3:::specific-bucket/*"],
+          "Resource": ["arn:aws:s3:::specific-bucket/*"],
           "Condition": {
             "StringEquals": {
               "s3:prefix": ["allowed-prefix/"]