filer: require admin-signed JWT on the IAM gRPC service (#9442)

Every IAM RPC (CreateUser, PutPolicy, CreateAccessKey, ...) now requires
a Bearer token in the authorization metadata, signed with the filer
write-signing key. The service refuses to register on a filer that has
no jwt.filer_signing.key set, so the unauthenticated default is gone:
operators who use these RPCs must configure the key and attach a token
on every call.

Bearer scheme matching is case-insensitive (RFC 6750), every handler
nil-checks req before dereferencing it, and tests now cover the
expired-token path.

weed/command/scaffold/security.toml

@@ -44,6 +44,11 @@ expires_after_seconds = 10           # seconds
 # - f.e. the S3 API Shim generates the JWT
 # - the Filer server validates the JWT on writing
 # NOTE: This key is ALSO used as a fallback signing key for S3 STS if s3.iam.config does not specify a signingKey.
+# NOTE: This key is ALSO required to mount the IAM gRPC service (CreateUser,
+#       PutPolicy, CreateAccessKey, ...) on the filer. The filer refuses to
+#       register that service when the key is empty, and every IAM RPC must
+#       carry a Bearer token signed with this key in its "authorization"
+#       gRPC metadata. Mint such a token with security.GenJwtForFilerAdmin.
 # the jwt defaults to expire after 10 seconds.
 [jwt.filer_signing]
 key = ""