Support SigV4 presigned URL verification

[alukach]

Problem

The auth module only supports header-based SigV4 authentication (the Authorization header). When no Authorization header is present, the request is treated as anonymous.

AWS S3 presigned URLs encode the signature in query parameters instead:

• X-Amz-Algorithm
• X-Amz-Credential
• X-Amz-Date
• X-Amz-Expires
• X-Amz-SignedHeaders
• X-Amz-Signature
• X-Amz-Security-Token (for temporary credentials)

Currently these are ignored, so presigned URLs generated with STS credentials are treated as anonymous requests.

Why it matters

Presigned URLs are commonly used for:

• Direct <img>/<a> tags in browsers (can't set Authorization header)
• Sharing time-limited download links for restricted data
• Any context where the HTTP client can't set custom headers

Without this, the STS credential flow only works for SDK-based requests that set the Authorization header.

What needs to change

1. resolve_identity() in auth/identity.rs — when the Authorization header is absent, check query parameters for X-Amz-Algorithm=AWS4-HMAC-SHA256 before falling back to anonymous.

2. parse_sigv4_auth() in auth/sigv4.rs — add a parallel code path (or new function) to extract credential, signed headers, and signature from query parameters instead of the header.

3. Signature verification — presigned URL canonical requests differ from header-based ones:

   • The X-Amz-Signature parameter is excluded from the canonical query string
   • The payload hash is always UNSIGNED-PAYLOAD
   • Expiration (X-Amz-Expires) must be validated

4. Credential resolution — the existing CredentialRegistry + TokenKey resolver should work as-is once the access key is extracted from the query string.

References

• AWS SigV4 Query String Auth