s3vectors: e2e conformance for vector bucket policy evaluation (#12221)

* s3vectors: reject empty boolean-operator lists and sub-objects in filters

An empty $and/$or list or a nested empty object rendered '()'' — invalid
SQL surfaced as an engine error instead of a clean ValidationException.

* s3vectors: e2e conformance for vector bucket policy evaluation

The handler-level test covers statements; this runs the whole stack a
client sees — HTTP dispatch, authentication, policy evaluation, catalog,
engine — and walks the full lifecycle: a non-owner is denied without a
grant, an Allow on the bucket ARN grants every index under it, a Deny
vetoes an Allow on the same action, and deleting the policy restores
owner-only access.

* s3vectors: prove deny precedence and grant removal in policy e2e

* s3vectors: reject field operator objects with no operators

* test: use an s3vectors action in the vector policy round-trip

test/vectors/s3vectors_test.py

@@ -79,7 +79,7 @@ def test_vector_bucket_policy(vectors):
                     {
                         "Effect": "Allow",
                         "Principal": {"AWS": "*"},
-                        "Action": "s3tables:*",
+                        "Action": "s3vectors:*",
                         "Resource": "*",
                     }
                 ],