s3vectors: validate index ARNs and expand live integration coverage (#12222)

* test: align vector bucket policy coverage with vector actions

* s3vectors: validate ARN service and resource shape before resolving indexes

* test: exercise signed vector bucket policies and catalog lifecycle

* ci: require the expanded vector integration matrix and all gateway tests

* test: reject index ARNs in bucket-level API requests

* s3vectors: scope ARN resolution to the gateway namespace

* s3vectors: reject name fields that conflict with resolved ARNs

bucketARNs and resolveIndexARNs already reject an indexArn that names a
different bucket than vectorBucketArn, but a vectorBucketName or
indexName disagreeing with the ARNs was silently dropped. Validate the
plain names against the resolved ARN values the same way.

* test: cover conflicting vector names and ARNs in live requests

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

test/vectors/conftest.py

@@ -155,3 +155,13 @@ def vectors(cluster):
     return boto3.client("s3vectors", endpoint_url=cluster["endpoint"],
                         aws_access_key_id="test", aws_secret_access_key="test", region_name="us-east-1",
                         config=Config(connect_timeout=3, read_timeout=20, retries={"max_attempts": 0}))
+
+
+@pytest.fixture(scope="module")
+def vector_clients(vectors):
+    return {
+        name: boto3.client("s3vectors", endpoint_url=vectors.meta.endpoint_url,
+                           aws_access_key_id=name, aws_secret_access_key=name + "-secret",
+                           region_name="us-east-1", config=vectors.meta.config)
+        for name in ("reader", "writer")
+    }