fix: harden CORS and replication request trust

Keep pre-authentication CORS lookups resident-only so attacker-controlled path segments cannot trigger metadata I/O or grow the metadata cache. Preserve fail-closed behavior for startup, load failures, invalid metadata, and the internal namespace.

Centralize replication request trust after authentication, distinguish general replication from replica-only privileges, and gate SSE-C ciphertext handling, source metadata, object-lock bypasses, event suppression, delete semantics, and replica status on the appropriate permission. Add least-privilege, multipart, PostPolicy, CORS amplification, and compatibility regressions.

Signed-off-by: Feng Ruohang <rh@vonng.com>

internal/bucket/object/lock/lock_test.go

@@ -386,7 +386,7 @@ func TestParseObjectLockRetentionHeaders(t *testing.T) {
 	}
 
 	for i, tt := range tests {
-		_, _, err := ParseObjectLockRetentionHeaders(tt.header)
+		_, _, err := ParseObjectLockRetentionHeaders(tt.header, false)
 		//nolint:gocritic
 		if tt.expectedErr == nil {
 			if err != nil {
@@ -398,6 +398,14 @@ func TestParseObjectLockRetentionHeaders(t *testing.T) {
 			t.Fatalf("Case %d error: expected = %v, got = %v", i, tt.expectedErr, err)
 		}
 	}
+
+	past := http.Header{
+		xhttp.AmzObjectLockMode:            []string{"governance"},
+		xhttp.AmzObjectLockRetainUntilDate: []string{"2017-01-02T15:04:05Z"},
+	}
+	if _, _, err := ParseObjectLockRetentionHeaders(past, true); err != nil {
+		t.Fatalf("trusted replica past retention date: %v", err)
+	}
 }
 
 func TestGetObjectRetentionMeta(t *testing.T) {