fix(batch): authorize the versions that a purge of all versions deletes

A batch expiration that keeps no versions authorized the versions its
walk saw, and the purge then deleted the versions it read under its
lock. A version written after the walk, or tags changed on one since,
was deleted without being authorized for the submitter.

The purge takes an authorization that a batch purge must set and no
other delete may. Under the object lock, once it has approved the
history and checked every drive, and before its first delete, it
hands the writes it is about to delete to the job: every copy of every
approved version and every revision of one that a drive holds, one per
distinct version ID and tags, as they are then. The job evaluates the
expire actions on each for the submitter. A denial deletes nothing and
ends the job as refused; the time it takes counts against the purge's
budget. A locked version still refuses the whole key, counted as a
refused key. The checks on the walk's snapshot are removed.

Reviewed adversarially; the review's regressions are included.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/object-api-interface.go

@@ -113,6 +113,12 @@ type ObjectOptions struct {
 	// DeleteAllResult, when set, receives what a purge of all versions
 	// confirmed, also when it fails part way.
 	DeleteAllResult *deleteAllResult
+	// deleteAllAuthorize authorizes a batch purge of all versions, which
+	// needs it, on every copy of every version the purge approved and every
+	// revision of one that a drive holds, one of each distinct version ID
+	// and tags, before it deletes any; its error refuses the key and is
+	// returned. Set by batch expiration only, never from a request.
+	deleteAllAuthorize func(versions []ObjectInfo) error
 
 	// Pools-layer version resolver; the caller holds the shared object lock.
 	replicaObjectInfo GetObjectInfoFn