s3vectors: validate index ARNs and expand live integration coverage (#12222)

* test: align vector bucket policy coverage with vector actions

* s3vectors: validate ARN service and resource shape before resolving indexes

* test: exercise signed vector bucket policies and catalog lifecycle

* ci: require the expanded vector integration matrix and all gateway tests

* test: reject index ARNs in bucket-level API requests

* s3vectors: scope ARN resolution to the gateway namespace

* s3vectors: reject name fields that conflict with resolved ARNs

bucketARNs and resolveIndexARNs already reject an indexArn that names a
different bucket than vectorBucketArn, but a vectorBucketName or
indexName disagreeing with the ARNs was silently dropped. Validate the
plain names against the resolved ARN values the same way.

* test: cover conflicting vector names and ARNs in live requests

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

test/vectors/s3.json

@@ -15,6 +15,30 @@
         "Tagging",
         "Write"
       ]
+    },
+    {
+      "name": "reader",
+      "credentials": [
+        {
+          "accessKey": "reader",
+          "secretKey": "reader-secret"
+        }
+      ],
+      "actions": [
+        "Read"
+      ]
+    },
+    {
+      "name": "writer",
+      "credentials": [
+        {
+          "accessKey": "writer",
+          "secretKey": "writer-secret"
+        }
+      ],
+      "actions": [
+        "Write"
+      ]
     }
   ]
 }