s3: honor a bucket owner recorded as an identity (#10567)

* s3: resolve a bucket owner recorded as an identity

The admin UI and weed shell record a bucket's owner as an identity name in
s3-identity-id and never write the account id the S3 API stores alongside it,
so such a bucket looked unowned: its ACL owner fell back to the default admin
account, and under the default BucketOwnerEnforced ownership every object
uploaded to it was stamped with that account instead of the bucket owner.

Resolve the identity to its account when no account id is recorded, in the one
place both the bucket metadata and the bucket config derive the owner from.

* s3: drop the recorded account when the bucket owner is reassigned

Changing the owner of a bucket created through the S3 API left its old account
id behind, and that outranks the identity when the owner is resolved, so the
new owner never took effect for object ownership or the bucket ACL.

weed/shell/command_s3_bucket_owner.go

@@ -96,6 +96,9 @@ func (c *commandS3BucketOwner) Do(args []string, commandEnv *CommandEnv, writer
 				entry.Extended = make(map[string][]byte)
 			}
 			entry.Extended[s3_constants.AmzIdentityId] = []byte(owner)
+			// The S3 API derives the owning account from this identity when no
+			// account id is recorded; a leftover one would keep the old owner.
+			delete(entry.Extended, s3_constants.ExtAmzOwnerKey)
 			fmt.Fprintf(writer, "Setting owner of bucket %s to: %s\n", *bucketName, owner)
 
 			// Update the entry
@@ -114,6 +117,7 @@ func (c *commandS3BucketOwner) Do(args []string, commandEnv *CommandEnv, writer
 		if *deleteOwner {
 			if entry.Extended != nil {
 				delete(entry.Extended, s3_constants.AmzIdentityId)
+				delete(entry.Extended, s3_constants.ExtAmzOwnerKey)
 			}
 			fmt.Fprintf(writer, "Removing owner from bucket %s\n", *bucketName)