s3: tighten STS session token handling (#11383)

* s3api: test that a session token must not reveal its credential

* sts: derive secret access key with HMAC keyed on the signing key

* s3api: stop accepting STS session tokens as bearer credentials

* security: reject STS session tokens on filer and admin gRPC auth

* test: sign s3/iam framework requests with the session credential

* s3api: exercise the real auth pipeline in the end-to-end harness

weed/s3api/s3api_server_grpc.go

@@ -46,6 +46,9 @@ func (s3a *S3ApiServer) checkAdminAuth(ctx context.Context) error {
 	if err != nil || parsed == nil || !parsed.Valid {
 		return status.Error(codes.Unauthenticated, "invalid admin token")
 	}
+	if claims, ok := parsed.Claims.(*security.SeaweedFilerAdminClaims); !ok || claims.SessionId != "" {
+		return status.Error(codes.Unauthenticated, "invalid admin token")
+	}
 	return nil
 }