feat(aws): support maximum-allowed S3 Express sessions (#840)

## Context

S3 Express CreateSession gives an omitted session-mode header distinct
semantics: AWS attempts the maximum privilege allowed by policy, trying
ReadWrite before falling back to ReadOnly. The existing API could only
request an explicit mode, forcing clients to choose without knowing the
caller's IAM permissions.

This adds a typed maximum-allowed grant selection that omits the header
while preserving the exact wire behavior of explicit ReadOnly and
ReadWrite grants. It remains within the existing Granter composition,
fixed five-minute session lifetime, and redaction boundary.

Fixes #835

Author: Xuanwo

services/aws-v4/src/lib.rs

@@ -162,8 +162,9 @@ pub use s3_access_grants::{
 };
 mod provide_credential;
 pub use provide_credential::{
-    S3ExpressSessionConfig, S3ExpressSessionGrant, S3ExpressSessionGranter, S3ExpressSessionMode,
-    S3ExpressSessionPartition, S3ExpressSessionProvider,
+    S3ExpressSessionConfig, S3ExpressSessionGrant, S3ExpressSessionGrantSelection,
+    S3ExpressSessionGranter, S3ExpressSessionMode, S3ExpressSessionPartition,
+    S3ExpressSessionProvider,
 };
 pub use reqsign_aws_core::constants;
 pub use reqsign_aws_core::{

services/aws-v4/src/provide_credential/mod.rs

@@ -17,6 +17,7 @@
 
 mod s3_express_session;
 pub use s3_express_session::{
-    S3ExpressSessionConfig, S3ExpressSessionGrant, S3ExpressSessionGranter, S3ExpressSessionMode,
-    S3ExpressSessionPartition, S3ExpressSessionProvider,
+    S3ExpressSessionConfig, S3ExpressSessionGrant, S3ExpressSessionGrantSelection,
+    S3ExpressSessionGranter, S3ExpressSessionMode, S3ExpressSessionPartition,
+    S3ExpressSessionProvider,
 };