s3: evaluate multipart completion conditions under the object lock (#12209)

* filer_pb,filer: per-mutation preconditions on ObjectTransaction

A transaction's request-level condition evaluates one entry before any
mutation runs, so a commit guarding two paths — the object it publishes
and the upload directory it assembles — could not be expressed. Give each
ObjectMutation an optional condition (evaluated against condition_key,
else the mutation's target, under the same lock just before the mutation
applies) and report which mutation failed through failed_mutation on the
response, so callers can tell a mutation guard's rejection apart from the
request-level precondition's.

* s3: evaluate multipart completion conditions under the object lock

CompleteMultipartUpload checked conditional headers gateway-side before
committing, and the routed commit transaction guarded only the upload
directory — nothing made If-None-Match: * atomic with the publish, so
concurrent conditional completions of the same absent key could all
report success.

The request's reducible write condition (If-None-Match/If-Match, star or
single strong ETag) now rides the commit as the transaction's request
condition on the owner filer: on the object path for unversioned buckets,
falling back to the .versions directory for suspended and enabled
versioning. The upload-exists guard moves onto the PUT mutation, keeping
its check-before-publish ordering. Conditions the reducer cannot express
stay on the distributed write lock, where check and commit already
serialize.

* filer,s3: resolve the latest version first for versioned conditional writes

* filer: keep directory entries holding content out of the absent-slot rule

* s3: keep a gateway-side upload-exists check for filers without mutation conditions

* filer: honor null-version-is-latest resolving prefer-alt conditions

* drop scratch multipart-race repro programs

* s3: note the write lock does not cover routed writes on non-reducible conditions

other/java/client/src/main/proto/filer.proto

@@ -359,6 +359,8 @@ message ObjectMutation {
     bool touch_mtime = 12;                 // PATCH_EXTENDED: set the entry's Mtime to now (e.g. a metadata-replace copy)
     bool remove_empty_parent = 13;         // DELETE: also remove the parent directory when the delete leaves it empty (best-effort)
     bool keep_remote_object = 14;          // DELETE: leave the object on the mounted remote storage
+    WriteCondition condition = 15;         // optional precondition checked under the transaction lock just before this mutation applies
+    string condition_key = 16;             // entry the condition evaluates against; empty = the mutation's target
 }
 
 // Recompute re-derives a pointer entry (directory/name on the mutation) from the
@@ -404,6 +406,7 @@ message ObjectTransactionRequest {
 message ObjectTransactionResponse {
     string error = 1;
     FilerError error_code = 2;
+    optional int32 failed_mutation = 3;  // index of the mutation that failed (its condition or its apply); unset when the request-level condition failed
 }
 
 // PosixLockRange is one advisory byte-range lock. Owner identity is (sid, owner):