fix: enforce SignedHeaders validation for SigV4 requests

[niksis02]

Validate incoming request headers against the client-provided SignedHeaders for both Authorization-header SigV4 requests and presigned URLs.

During request reconstruction, only signed headers and explicitly ignored headers are copied into the generated request used for signature verification. If an incoming header is present, is required to be signed, and is missing from SignedHeaders, return a new AccessDenied response with a HeadersNotSigned field.

Previously, a client could sign a request without an S3 control header and then add that header after signing. For example, a presigned PUT URL could be generated with only host signed, then the actual request could include an unsigned X-Amz-Tagging or X-Amz-Copy-Source header. Because the verifier reconstructed the request only from SignedHeaders, that extra header was omitted from signature calculation and could pass authentication even though it changed the request semantics. This is now rejected with AccessDenied.

Update SigV4 header rules so all X-Amz-* headers are treated as required signed headers to match the S3 behavior.

Expose v4 helper methods for checking required and ignored headers, and update canonical header signing so ignored headers can still be included when a client explicitly lists them in SignedHeaders, while Authorization remains excluded from signature calculation.