s3vectors: validate index ARNs and expand live integration coverage (#12222)

* test: align vector bucket policy coverage with vector actions

* s3vectors: validate ARN service and resource shape before resolving indexes

* test: exercise signed vector bucket policies and catalog lifecycle

* ci: require the expanded vector integration matrix and all gateway tests

* test: reject index ARNs in bucket-level API requests

* s3vectors: scope ARN resolution to the gateway namespace

* s3vectors: reject name fields that conflict with resolved ARNs

bucketARNs and resolveIndexARNs already reject an indexArn that names a
different bucket than vectorBucketArn, but a vectorBucketName or
indexName disagreeing with the ARNs was silently dropped. Validate the
plain names against the resolved ARN values the same way.

* test: cover conflicting vector names and ARNs in live requests

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/workflows/rust-vector-tests.yml

@@ -131,7 +131,9 @@ jobs:
           test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
           echo "PROTOC=$protoc" >> "$GITHUB_ENV"
       - name: Test Go vector gateway
-        run: go test ./weed/s3api/s3vectors ./weed/command -run 'Vector|Vectors' -count=1
+        run: |
+          go test ./weed/s3api/s3vectors -count=1
+          go test ./weed/command -run 'Vector|Vectors' -count=1
       - name: Build integration binaries
         working-directory: test/vectors
         run: make build CARGO_PROFILE=dev
@@ -149,10 +151,10 @@ jobs:
           from pathlib import Path
           import xml.etree.ElementTree as ET
           cases = ET.parse(Path(os.environ["RUNNER_TEMP"]) / "vector-results.xml").findall(".//testcase")
-          assert len(cases) >= 24, f"expected at least 24 cases, got {len(cases)}"
+          assert len(cases) >= 34, f"expected at least 34 cases, got {len(cases)}"
           assert not any(case.find("skipped") is not None for case in cases), "integration cases were skipped"
           for volume in ("go", "rust"):
-              assert sum(case.get("name", "").endswith(f"[{volume}-single]") for case in cases) >= 12, volume
+              assert sum(case.get("name", "").endswith(f"[{volume}-single]") for case in cases) >= 17, volume
           PYTHON
       - name: Upload integration diagnostics
         if: always()