fix(s3): enforce tag count and object lock permissions on proxy reads

Skip x-amz-tagging-count and X-Amz-Tagging in setObjectHeaders UserDefined iteration and proxyHeadToRepTarget metadata copies so opts.TaggingCount/opts.Tagging remains the sole gate without emitting duplicate headers. Make FilterObjectLockMetadata case-insensitive so canonical-case X-Amz-Object-Lock-* headers from peer HEAD responses are stripped when s3:GetObjectRetention or s3:GetObjectLegalHold is denied while preserved for authorized callers.

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/api-headers.go

@@ -159,6 +159,11 @@ func setObjectHeaders(ctx context.Context, w http.ResponseWriter, objInfo Object
 			continue
 		}
 
+		// Tag count and tag values are gated above by opts.TaggingCount / opts.Tagging.
+		if equals(k, xhttp.AmzTagCount, xhttp.AmzObjectTagging) {
+			continue
+		}
+
 		// https://github.com/google/security-research/security/advisories/GHSA-76wf-9vgp-pj7w
 		if equals(k, xhttp.AmzMetaUnencryptedContentLength, xhttp.AmzMetaUnencryptedContentMD5) {
 			continue