ResolveS3Action derives the authorized action from the request's
method+query, overriding the caller's base action. A governance-bypass
check on DELETE ?versionId=... therefore evaluated s3:DeleteObjectVersion
instead of s3:BypassGovernanceRetention, letting an identity that holds
version-delete but not bypass delete a GOVERNANCE-locked version
(GHSA-j4hf-8r83-7fjj). The same substitution let s3:GetObjectVersion
satisfy GetObjectRetention/GetObjectLegalHold on ?versionId requests,
and silently dropped bucket-policy grants of the bypass action on
versioned deletes.
Object Lock actions name a concrete permission checked on top of another
operation's shape; resolve them to themselves, like iam:/sts: actions.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
