Authorize explicit object-version deletes with s3:DeleteObjectVersion

[metaneutrons]

Problem

Silo currently authorizes both current-object deletes and explicit version deletes with s3:DeleteObject.

The affected paths are:

• DeleteObjectHandler in cmd/object-handlers.go
• per-entry authorization in DeleteMultipleObjectsHandler in cmd/bucket-handlers.go
• the compatibility block in cmd/auth-handler.go, which still requires DeleteObject and only applies an explicit deny check for DeleteObjectVersion

AWS S3 requires:

• DELETE without versionId: s3:DeleteObject
• DELETE with an explicit versionId (including the null version): s3:DeleteObjectVersion

This matters for least-privilege retention/purge principals that may delete exact immutable versions but must not be able to create delete markers or delete the current object.

Related upstream MinIO report: minio#21735

Proposed change

• Select the authorization action from the effective version ID:
  • empty version ID -> DeleteObject
  • non-empty version ID -> DeleteObjectVersion
• Apply that selection to both single DELETE and each entry in multi-delete.
• Preserve the effective per-entry versionid condition value for multi-delete.
• Remove the legacy dual-action/DenyOnly compatibility behavior once the correct action is selected.
• Add regression coverage for:
  • version-only permission allows exact version deletion but denies an unversioned delete/delete-marker creation
  • object-delete-only permission allows unversioned delete but denies explicit version deletion
  • mixed multi-delete authorization
  • explicit versionId=null
  • deny precedence and version-ID conditions

No API or storage-format change is intended. The compatibility change is limited to bringing authorization in line with the documented AWS S3 action mapping.