feat(aws): support custom S3 Express CreateSession endpoints (#843)

## Context

S3 Express `CreateSession` configuration only accepted AWS
directory-bucket names and derived AWS or AWS China Zonal endpoints.
That excluded S3-compatible deployments which expose `CreateSession` at
a deployment-owned origin. A concrete documented example is [MinIO
AIStor S3 Express
mode](https://docs.min.io/aistor/reference/aistor-server/s3-express/),
whose [S3 API compatibility
reference](https://docs.min.io/aistor/developers/s3-api-compatibility/)
lists `CreateSession`.

This adds a separate, fallible
`S3ExpressSessionGranter::new_with_custom_endpoint` path that binds the
compatible bucket, SigV4 Region, and HTTPS origin before source
credentials can be loaded. It preserves the strict AWS constructor and
exposes no synthetic Zone or partition. `custom` means
caller-configured, not verified: reqsign validates endpoint syntax but
cannot determine service identity or protocol compatibility. The
configured origin receives the AWS `Authorization` header and any source
`x-amz-security-token`.

Live AWS and MinIO AIStor interoperability were not run because this
checkout has no authorized endpoint or credential environment.
Deterministic wire coverage does not establish interoperability.

Fixes #838

Author: Xuanwo