feat: s3proxy default to credential chain with optional anonymous access

When access/secret are not provided, let AWS SDK v2 resolve credentials
from the default provider chain (env vars, IRSA, ECS/EC2 roles, etc.)
instead of forcing anonymous credentials.

Add an explicit anonymous credentials option for s3 proxy to force
backend anonymous access.

Fixes #1955

cmd/versitygw/s3.go

@@ -27,6 +27,7 @@ var (
 	s3proxyEndpoint                  string
 	s3proxyRegion                    string
 	s3proxyMetaBucket                string
+	s3proxyAnonymousCredentials      bool
 	s3proxyDisableChecksum           bool
 	s3proxyDisableDataIntegrityCheck bool
 	s3proxySslSkipVerify             bool
@@ -78,6 +79,13 @@ to an s3 storage backend service.`,
 				EnvVars:     []string{"VGW_S3_META_BUCKET"},
 				Destination: &s3proxyMetaBucket,
 			},
+			&cli.BoolFlag{
+				Name:        "anonymous-credentials",
+				Usage:       "force anonymous credentials instead of AWS default credential chain",
+				Value:       false,
+				EnvVars:     []string{"VGW_S3_ANONYMOUS_CREDENTIALS"},
+				Destination: &s3proxyAnonymousCredentials,
+			},
 			&cli.BoolFlag{
 				Name:        "disable-checksum",
 				Usage:       "disable gateway to server object checksums",
@@ -119,7 +127,7 @@ to an s3 storage backend service.`,
 
 func runS3(ctx *cli.Context) error {
 	be, err := s3proxy.New(ctx.Context, s3proxyAccess, s3proxySecret, s3proxyEndpoint, s3proxyRegion,
-		s3proxyMetaBucket, s3proxyDisableChecksum, s3proxyDisableDataIntegrityCheck, s3proxySslSkipVerify, s3proxyUsePathStyle, s3proxyDebug)
+		s3proxyMetaBucket, s3proxyAnonymousCredentials, s3proxyDisableChecksum, s3proxyDisableDataIntegrityCheck, s3proxySslSkipVerify, s3proxyUsePathStyle, s3proxyDebug)
 	if err != nil {
 		return fmt.Errorf("init s3 backend: %w", err)
 	}