s3: close seaweedfs-quota policy-confusion gap (#11409)

* s3: count seaweedfs-quota as an operation subresource

PUT /bucket?policy&seaweedfs-quota was not rejected by
hasAmbiguousSubresource because operationSubresources omitted the
seaweedfs-quota key. The router then picks the policy route
(registered first) while the IAM action resolver may resolve the
request to s3:PutBucketQuota, letting a quota-only identity write a
bucket policy. Reject the combination before routing, matching the
fix for policy&tagging (#10987).

* s3: resolve seaweedfs-quota after other bucket subresources

The quota routes are registered last among the bucket subresource
routes, but the action resolver found seaweedfs-quota inside the
unordered bucketQueryActions map, so a request carrying it alongside
another selector could be authorized as the quota operation while the
router served the earlier-registered handler. Resolve it explicitly at
the end so the resolver agrees with the router, mirroring how
list-type is handled.

* s3: count resolver subresources in the ambiguity guard

hasAmbiguousSubresource only counted operationSubresources, so adding
a query parameter to the action resolver without updating that list
reopened the authorize-one-serve-another gap. Count bucketQueryActions
keys as operation selectors too, and add a test that walks the
registered routes and fails on any query key that is neither an
operation subresource nor a known modifier.

weed/s3api/s3api_path_validation.go

@@ -53,14 +53,17 @@ var operationSubresources = map[string]bool{
 	"location": true, "logging": true, "metrics": true, "notification": true,
 	"object-lock": true, "ownershipControls": true, "policy": true, "policyStatus": true,
 	"publicAccessBlock": true, "renameObject": true, "replication": true,
-	"requestPayment": true, "retention": true, "tagging": true, "uploadId": true,
+	"requestPayment": true, "retention": true, "seaweedfs-quota": true,
+	"tagging": true, "uploadId": true,
 	"uploads": true, "versioning": true, "versions": true, "website": true,
 }
 
 func hasAmbiguousSubresource(query url.Values) bool {
 	seen := 0
 	for key := range query {
-		if !operationSubresources[key] {
+		// bucketQueryActions keys select an operation by definition, so they
+		// count even if operationSubresources was not updated for them.
+		if _, ok := bucketQueryActions[key]; !ok && !operationSubresources[key] {
 			continue
 		}
 		if seen++; seen > 1 {