feat: add STS web identity federation, IAM policy Condition support, and access control enforcement

Implements the `AssumeRoleWithWebIdentity` and `GetCallerIdentity` STS actions, letting callers exchange an external OIDC token for temporary credentials scoped to an IAM role. Token handling covers JWT claim parsing, issuer/audience resolution (including `azp` override semantics), JWKS fetching and caching with `singleflight`-deduplicated refresh, and rate-limited forced refresh on unrecognized `kid` values. OIDC provider thumbprint fetching now performs a real TLS handshake verified against the system trust store and the provider hostname (previously `InsecureSkipVerify`), since the observed certificate is persisted as a long-lived trust anchor rather than used once and discarded; all discovery-document and JWKS fetches go through an SSRF-safe HTTP client with bounded redirects and response size.

Adds policy `Condition` block evaluation, supporting `String`, `Numeric`, `Date`, `Bool`, `BinaryEquals`, and `IpAddress` operators along with their `IfExists`/`Not` variants and `ForAllValues`/`ForAnyValues` set qualifiers, plus policy variable substitution (e.g. `${aws:username}`) in supported operators. Adds identity-based inline policy evaluation and a new IAM authorization middleware that authorizes each request against action, resource, and condition context together, applying the session-policy-intersects-role-policy semantics for assumed-role sessions.

Adds a new debug logger `--log-level` flag (`silent`/`debug`/`unsafe`), along with a tree-based XML masker that redacts secrets and tokens at the property level in logged request/response bodies instead of skipping the whole body. The old `--debug/VGW_DEBUG` flag is kept as a deprecated alias for `--log-level=debug`, printing a console warning that points users at `--log-level` for finer-grained control.

Fixes a Vault storage bug where CAS (check-and-set) writes always read the current document version as 0 because `kvVersion` asserted metadata as `float64` while the Vault client actually returns `json.Number`, causing every write past the first to be rejected as a concurrent modification. Also adds a constant-time `SecureCompare` for signature/token comparisons in sigv4 auth.

Adds an integration test suite (`iam_access_control.go`) covering IAM access control across user, role, and session identities.

extra/example.conf

@@ -363,9 +363,28 @@ ROOT_SECRET_ACCESS_KEY=
 # Debug / Diagnostics #
 #######################
 
-# The VGW_DEBUG option enables verbose debug log output to stdout. This output
-# includes details for signature verification steps. This is generally only
-# useful for debugging the S3 server, and should not be used in production.
+# The VGW_LOG_LEVEL option controls the verbosity and safety of the debug
+# logger's output to stdout, which includes full request/response headers
+# and bodies, and details for signature verification steps. It accepts one
+# of the following values:
+#   silent  - (default) no debug output.
+#   debug   - full request/response logging, with secrets and tokens (e.g.
+#             access keys, secret keys, session tokens, signatures, SSE-C
+#             customer keys) masked at the property level.
+#   unsafe  - full request/response logging with NO masking. Every secret
+#             and token is printed to stdout in the clear.
+#
+# WARNING: be very careful with VGW_LOG_LEVEL=unsafe. It logs account
+# secrets, session tokens, and other credentials to the console with no
+# masking at all -- anyone who can read that output can replay them
+# directly. Only use "unsafe" for local troubleshooting on a trusted
+# machine, and never in production.
+#VGW_LOG_LEVEL=silent
+
+# The VGW_DEBUG option is a deprecated alias for VGW_LOG_LEVEL=debug, kept
+# only for backward compatibility. Setting it to true prints a deprecation
+# warning to the console and enables debug-level logging; use VGW_LOG_LEVEL
+# instead for finer-grained control (including "unsafe" mode).
 #VGW_DEBUG=false
 
 # The VGW_PPROF option enables the pprof HTTP server for profiling the S3