Prepare SILO 20261112 release candidate

Harden IAM/bucket/import/replication policy validation, enforce tag and
version authorization across read/copy/list/archive endpoints, bind SigV4
credential-scope dates and streaming trailer limits, validate HTTP SSE-KMS
contexts as strict UTF-8 JSON, add release-commit and coordinated
dependency gates, and pin silo-pkg v3.16.1, Console v2.7.1, mcli 20261112,
Go 1.27.4, and Helm chart 7.0.5.

Signed-off-by: Feng Ruohang <rh@vonng.com>

internal/crypto/sse-kms.go

@@ -24,6 +24,7 @@ import (
 	"net/http"
 	"path"
 	"strings"
+	"unicode/utf8"
 
 	jsoniter "github.com/json-iterator/go"
 	xhttp "github.com/minio/minio/internal/http"
@@ -79,6 +80,15 @@ func (ssekms) ParseHTTP(h http.Header) (string, kms.Context, error) {
 		if err != nil {
 			return "", nil, err
 		}
+		// Persisting invalid UTF-8 replaces bytes and can collapse distinct
+		// keys, changing the associated data needed to decrypt the object.
+		if !utf8.Valid(b) {
+			return "", nil, kms.Error{
+				Code:    http.StatusBadRequest,
+				APICode: "InvalidArgument",
+				Err:     "KMS context must be valid UTF-8",
+			}
+		}
 
 		json := jsoniter.ConfigCompatibleWithStandardLibrary
 		if err := json.Unmarshal(b, &ctx); err != nil {