fix(iam): normalize service policies and preserve imported state

Keep omitted edit policies unchanged, reset valid empty policies to inheritance, and normalize nonempty policies without a version before storage. Preserve caller policy objects and exclude derived authorization claims from snapshots and new JWTs.

Restore imported service-account and group status, report the actual group error, and cover creation, editing, replication, import/export and raw JWT claims with focused server tests.

Refs #339, #345.

Signed-off-by: Feng Ruohang <rh@vonng.com>
(cherry picked from commit 86e4c09d47f48cb2f44fb2f63f02f222ac6ae102)

cmd/admin-handlers-users-authz_test.go

@@ -169,8 +169,9 @@ func TestIAMAdminEmptyPolicyDelegation(t *testing.T) {
 					{"{}", http.StatusOK, true},
 					{`{"Statement":null}`, http.StatusOK, true},
 					{limitedPolicy, http.StatusOK, false},
-					{`{"Version":"2012-10-17"}`, http.StatusForbidden, false},
-					{`{"Statement":[]}`, http.StatusForbidden, false},
+					{`{"Version":"2012-10-17"}`, http.StatusOK, true},
+					{`{"Statement":[]}`, http.StatusOK, true},
+					{`{"Version":"2012-10-17","Statement":[]}`, http.StatusOK, true},
 				} {
 					expires := UTCNow().Add(time.Hour)
 					req := madmin.AddServiceAccountReq{Expiration: &expires}