fix(federation): bind copy timestamps to committed writes

Return the committed object or part time on federation write responses and
capture it for CopyObject and UploadPartCopy without a follow-up read.
Keep successful writes compatible with targets that do not supply a time.

Reject authenticated raw SSE-C replica CopyObject across deployments before
forwarding. Extend the existing SSE fixtures to verify empty objects,
stored checksums, KMS contexts and multipart sources.

Refs: #169, #168, #171
Signed-off-by: Feng Ruohang <rh@vonng.com>

buildscripts/rebrand-guard/compat-baseline.json

@@ -627,6 +627,7 @@
     "x-minio-internal-transitioned-object",
     "x-minio-internal-xyz",
     "x-minio-key",
+    "x-minio-last-modified",
     "x-minio-lifecycleconfig-updatedat",
     "x-minio-meta",
     "x-minio-meta-appid",
@@ -1071,6 +1072,7 @@
     "cmd/metrics.go=\"Version of current MinIO server instance\"",
     "cmd/metrics.go=\"minio\"",
     "cmd/object-api-utils.go=\".minio.sys\"",
+    "cmd/object-handlers-common.go=\"X-Minio-Last-Modified\"",
     "cmd/object-handlers.go=\"minio-federated\"",
     "cmd/object-handlers.go=\"minio.metadata.\"",
     "cmd/object-handlers.go=\"minio.versionId\"",