Prepare SILO 20261112 release candidate

Harden IAM/bucket/import/replication policy validation, enforce tag and
version authorization across read/copy/list/archive endpoints, bind SigV4
credential-scope dates and streaming trailer limits, validate HTTP SSE-KMS
contexts as strict UTF-8 JSON, add release-commit and coordinated
dependency gates, and pin silo-pkg v3.16.1, Console v2.7.1, mcli 20261112,
Go 1.27.4, and Helm chart 7.0.5.

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/streaming-v4-unsigned.go

@@ -217,8 +217,12 @@ func (cr *s3UnsignedChunkedReader) readTrailers() error {
 			if err == io.EOF {
 				return io.ErrUnexpectedEOF
 			}
+			return err
 		}
 		if v != '\r' {
+			if valueBuffer.Len() >= maxTrailerSize {
+				return errMalformedEncoding
+			}
 			valueBuffer.WriteByte(v)
 			continue
 		}
@@ -229,6 +233,7 @@ func (cr *s3UnsignedChunkedReader) readTrailers() error {
 			if err == io.EOF {
 				return io.ErrUnexpectedEOF
 			}
+			return err
 		}
 		if !bytes.Equal(tmp[:], []byte{'\n', '\r', '\n'}) {
 			if cr.debug {