Prepare SILO 20261112 release candidate

Harden IAM/bucket/import/replication policy validation, enforce tag and
version authorization across read/copy/list/archive endpoints, bind SigV4
credential-scope dates and streaming trailer limits, validate HTTP SSE-KMS
contexts as strict UTF-8 JSON, add release-commit and coordinated
dependency gates, and pin silo-pkg v3.16.1, Console v2.7.1, mcli 20261112,
Go 1.27.4, and Helm chart 7.0.5.

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/signature-v4.go

@@ -189,6 +189,16 @@ func doesPolicySignatureV4Match(formValues http.Header) (auth.Credentials, APIEr
 		return cred, s3Err
 	}
 
+	if dateStr := formValues.Get(xhttp.AmzDate); dateStr != "" {
+		t, err := time.Parse(iso8601Format, dateStr)
+		if err != nil {
+			return cred, ErrMalformedDate
+		}
+		if credHeader.scope.date.Format(yyyymmdd) != t.UTC().Format(yyyymmdd) {
+			return cred, ErrSignatureDoesNotMatch
+		}
+	}
+
 	// Get signing key.
 	signingKey := getSigningKey(cred.SecretKey, credHeader.scope.date, credHeader.scope.region, serviceS3)
 
@@ -248,6 +258,9 @@ func doesPresignedSignatureMatch(hashedPayload string, r *http.Request, region s
 
 	// Save the date and expires.
 	t := pSignValues.Date
+	if pSignValues.Credential.scope.date.Format(yyyymmdd) != t.UTC().Format(yyyymmdd) {
+		return ErrSignatureDoesNotMatch
+	}
 	expireSeconds := int(pSignValues.Expires / time.Second)
 
 	// Construct new query.
@@ -388,6 +401,9 @@ func doesSignatureMatch(hashedPayload string, r *http.Request, region string, st
 	if e != nil {
 		return ErrMalformedDate
 	}
+	if signV4Values.Credential.scope.date.Format(yyyymmdd) != t.UTC().Format(yyyymmdd) {
+		return ErrSignatureDoesNotMatch
+	}
 
 	// Query string.
 	queryStr := req.Form.Encode()