fix: fixes the HeadObject version access control with policies.

Fixes #1385

When accessing a specific object version, the user must have the `s3:GetObjectVersion` permission in the bucket policy. The `s3:GetObject` permission alone is not sufficient for a regular user to query object versions using `HeadObject`.

This PR fixes the issue and adds integration tests for both `HeadObject` and `GetObject`. It also includes cleanup in the integration tests by refactoring the creation of user S3 clients, and moves some test user data to the package level to avoid repetition across tests.

s3api/controllers/object-get.go

@@ -388,7 +388,7 @@ func (c S3ApiController) GetObject(ctx *fiber.Ctx) (*Response, error) {
 	utils.ContextKeySkipResBodyLog.Set(ctx, true)
 
 	action := auth.GetObjectAction
-	if versionId != "" {
+	if ctx.Request().URI().QueryArgs().Has("versionId") {
 		action = auth.GetObjectVersionAction
 	}
 

s3api/controllers/object-head.go

@@ -41,6 +41,11 @@ func (c S3ApiController) HeadObject(ctx *fiber.Ctx) (*Response, error) {
 	objRange := ctx.Get("Range")
 	key := strings.TrimPrefix(ctx.Path(), fmt.Sprintf("/%s/", bucket))
 
+	action := auth.GetObjectAction
+	if ctx.Request().URI().QueryArgs().Has("versionId") {
+		action = auth.GetObjectVersionAction
+	}
+
 	err := auth.VerifyAccess(ctx.Context(), c.be,
 		auth.AccessOptions{
 			Readonly:       c.readonly,
@@ -50,7 +55,7 @@ func (c S3ApiController) HeadObject(ctx *fiber.Ctx) (*Response, error) {
 			Acc:            acct,
 			Bucket:         bucket,
 			Object:         key,
-			Action:         auth.GetObjectAction,
+			Action:         action,
 			IsBucketPublic: isPublicBucket,
 		})
 	if err != nil {

s3api/controllers/object-head_test.go

@@ -57,6 +57,7 @@ func TestS3ApiController_HeadObject(t *testing.T) {
 				locals: defaultLocals,
 				queries: map[string]string{
 					"partNumber": "-4",
+					"versionId":  "id",
 				},
 			},
 			output: testOutput{