s3tables: re-anchor legacy owners for federated STS sessions

A web-identity role session was keyed on its bare OIDC subject until
owners became issuer-scoped. Its sessions now carry the scoped aws:userid
but no asserted issuers, so the legacy subject check never applied and the
session lost the table buckets and namespaces it had created. Read the
configured issuer set for such sessions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

weed/s3api/s3api_tables.go

@@ -2,6 +2,7 @@ package s3api
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -63,6 +64,12 @@ func (st *S3TablesApiServer) SetEncryptionChecker(fn func() bool) {
 	st.handler.SetEncryptionChecker(fn)
 }
 
+// SetTrustedIssuerSource injects the configured OIDC issuer set for S3 Tables
+// legacy-owner checks of federated STS sessions.
+func (st *S3TablesApiServer) SetTrustedIssuerSource(fn func(context.Context) []string) {
+	st.handler.SetTrustedIssuerSource(fn)
+}
+
 // S3TablesHandler handles S3 Tables API requests
 func (st *S3TablesApiServer) S3TablesHandler(w http.ResponseWriter, r *http.Request) {
 	st.handler.HandleRequest(w, r, st)
@@ -85,6 +92,7 @@ func (s3a *S3ApiServer) registerS3TablesRoutes(router *mux.Router) {
 		s3TablesApi.SetDefaultAllow(s3a.iam.iamIntegration.DefaultAllow())
 		if s3Integration, ok := s3a.iam.iamIntegration.(*S3IAMIntegration); ok && s3Integration.iamManager != nil {
 			s3TablesApi.SetIAMAuthorizer(s3Integration.iamManager)
+			s3TablesApi.SetTrustedIssuerSource(s3Integration.trustedOIDCIssuers)
 		}
 	} else {
 		// If IAM is not configured, allow all access by default