fix(s3api): reject zero default retention years (#9860)

Problem: Default object-lock retention accepted an explicitly provided Years value of zero, even though a default retention period must be positive when present.

Root cause: validateDefaultRetention rejected zero Days but only rejected negative Years, leaving YearsSet with Years=0 as a successful validation path.

Fix: Treat an explicitly provided zero Years value as ErrInvalidRetentionPeriod, matching the existing Days validation.

Reproduction: go test ./weed/s3api -run TestValidateDefaultRetention -count=1 failed before the fix because the Zero years case returned nil.

Validation: go test ./weed/s3api -run TestValidateDefaultRetention -count=1; go test ./weed/s3api -count=1; git diff --check; git diff --cached --check

weed/s3api/object_lock_utils.go

@@ -326,6 +326,11 @@ func validateDefaultRetention(retention *DefaultRetention) error {
 		return ErrInvalidRetentionPeriod
 	}
 
+	// Check for invalid Years value (zero is invalid when explicitly provided)
+	if retention.YearsSet && retention.Years == 0 {
+		return ErrInvalidRetentionPeriod
+	}
+
 	// Check for neither Days nor Years being specified
 	if !retention.DaysSet && !retention.YearsSet {
 		return ErrDefaultRetentionMissingPeriod