HDDS-16358. Gate S3 derived-key requests on OM version

[rich7420]

What changes were proposed in this pull request?

Add a dedicated S3_DERIVED_KEY OM version and gate derived-key requests across key and multipart writes. In secure mode, S3 Gateway returns NotImplemented before opening a key when the connected OM does not support chunk verification. A supporting OM that returns no derived key still fails with InternalError.

The capability is placed before ZDU, since derived keys are available before upgrade finalization. This preserves signed uploads on upgraded, unfinalized clusters.

What is the link to the Apache JIRA?

https://issues.apache.org/jira/browse/HDDS-16358

How was this patch tested?

With JDK 21 on the final Java changes:

• 323 unit tests passed across the OM version, client write-gating, S3 endpoint, and OM version-manager suites.
• TestOMUpgradeFinalization#testServiceInfoOmVersionTracksClientVersion passed on a three-OM HA cluster, checking the advertised version before and after finalization.
• Replacing the dedicated gate with the old version-14 floor caused 16 regression checks to fail. They passed after restoring the change.
• Checkstyle and PMD passed.

Latest fork CI is running. The previous 10×10 runs cover the earlier implementation; repeat checks on this updated head are still pending.

Generated-by: Codex (GPT-6)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[smengcl]

lgtm

[chungen0126]

Thanks @rich7420 for working on this.
Instead of reusing GET_FILE_STATUS_REJECTS_OBS to gate derived-key requests, I suggest introducing a dedicated new OzoneManagerVersion.

There is no need to reuse existing versions here. Defining an explicit, dedicated version makes it much clearer to everyone what capability each OM version represents and why it was introduced, which will also make future version checks and maintenance much more readable.