fix(iam): bind policy conditions to effective request values

Policy evaluation mixed server-derived identity and transport values with raw headers and query parameters. A client could therefore shadow internal condition keys, synthesize LDAP or JWT resource variables, substitute request tags for stored tags, or make a condition observe a value different from the one the handler actually used.

Partition condition sources, reserve internal names, adopt exact-name lookup from silo-pkg, and bind authorization to the effective request state. Preserve compatible query forms for storage class and upload tags with explicit header precedence, while restricting signature age and existing-object tags to authenticated or server-resolved values.

Tests sweep every supported key across header and query routes and exercise LDAP/OIDC variables, object-lock spelling, STS tags, metadata extraction, and end-to-end policy decisions.

Co-authored-by: ChatGPT <noreply@openai.com>
Co-authored-by: Claude <noreply@anthropic.com>

internal/handlers/proxy.go

@@ -85,6 +85,17 @@ func GetSourceScheme(r *http.Request) string {
 	return scheme
 }
 
+// SECURITY NOTE: these headers are trusted from any peer. There is no
+// trusted-proxy boundary, X-Forwarded-For is honoured by default, and X-Real-IP
+// and Forwarded are not gated at all, so any client that can reach the server
+// directly can set the address the rest of the process believes it came from.
+// That includes aws:SourceIp, which means an IpAddress policy condition is not
+// enforceable on a directly reachable deployment - put MinIO behind a proxy
+// that overwrites these headers, or set _MINIO_API_XFF_HEADER=off and keep the
+// other two out at the edge. Adding a trusted-proxy allowlist here would change
+// what every deployment behind a load balancer resolves to, so it is recorded
+// rather than changed.
+//
 // GetSourceIPFromHeaders retrieves the IP from the X-Forwarded-For, X-Real-IP
 // and RFC7239 Forwarded headers (in that order)
 func GetSourceIPFromHeaders(r *http.Request) string {