fix(s3): enforce tag count and object lock permissions on proxy reads

Skip x-amz-tagging-count and X-Amz-Tagging in setObjectHeaders UserDefined iteration and proxyHeadToRepTarget metadata copies so opts.TaggingCount/opts.Tagging remains the sole gate without emitting duplicate headers. Make FilterObjectLockMetadata case-insensitive so canonical-case X-Amz-Object-Lock-* headers from peer HEAD responses are stripped when s3:GetObjectRetention or s3:GetObjectLegalHold is denied while preserved for authorized callers.

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/bucket-replication.go

@@ -2711,6 +2711,9 @@ func proxyHeadToRepTarget(ctx context.Context, bucket, object string, rs *HTTPRa
 		}
 		oi.UserDefined = make(map[string]string, len(objInfo.Metadata))
 		for k, v := range objInfo.Metadata {
+			if equals(k, xhttp.AmzTagCount, xhttp.AmzObjectTagging) {
+				continue
+			}
 			oi.UserDefined[k] = v[0]
 		}
 		ce, ok := oi.UserDefined[xhttp.ContentEncoding]