s3api: verify x-amz-content-sha256 against the streamed body

A PUT carrying a hex or base64 payload hash now streams through a
verifier that reports a mismatch once the stream is exhausted, instead
of storing an object that does not match its declared hash. The error
is deferred so intermediate reads that drop (n>0, err) results cannot
silently swallow it. Sentinel values (unsigned/streaming payloads)
remain exempt and malformed values fail fast.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

weed/s3api/s3err/s3api_errors.go

@@ -180,6 +180,7 @@ const (
 
 // Error message constants for checksum validation
 const (
+	ErrMsgContentSha256Mismatch     = "the provided 'x-amz-content-sha256' header does not match what was computed"
 	ErrMsgPayloadChecksumMismatch   = "payload checksum does not match"
 	ErrMsgChunkSignatureMismatch    = "chunk signature does not match"
 	ErrMsgChecksumAlgorithmMismatch = "checksum algorithm mismatch"