fix: declare aws-chunked content encoding on streaming uploads - #2277

RDMA failure fixed in #2276

Description

Streaming SigV4 and unsigned-trailer uploads frame the request body as aws-chunked but never declare it. PR #1803 tried to declare it through req.TransferEncoding = []string{"aws-chunked"}, which Go's net/http silently drops (it only honors "chunked"), so nothing reached the wire and #1802 was reopened.

• Adds one idempotent helper, setAwsChunkedContentEncoding, used by all four production call sites: the shared signed-streaming preparer (StreamingSignV4/Express/Outposts), the unsigned-streaming preparer, and the two trailer paths in request-signature-v4.go.
• Sets Content-Encoding: aws-chunked before the seed signature is computed, so the header is signed. A caller-set encoding survives as aws-chunked,gzip (the two trailer paths previously clobbered it), multi-value headers are merged, and an already-present token (any case, with or without whitespace) is left unchanged.
• Removes the two dead req.TransferEncoding = []string{"aws-chunked"} writes.
• Updates two golden signatures (content-encoding now joins SignedHeaders). The AWS-docs-derived trailer golden is unchanged, which pins helper idempotence.
• Adds six tests: a 7-case table test asserting header value and SignedHeaders membership, an httptest wire round-trip, and one test per entry point (StreamingUnsignedV4, SignV4Trailer, UnsignedTrailer, multi-value header).

Motivation and Context

Fixes #1802. Servers that do not sniff x-amz-content-sha256 store the chunk framing as object data (see the issue thread and gitea#33638). The AWS SigV4 streaming spec lists Content-Encoding under the headers a chunked upload must include ("Set the value to aws-chunked ... For example: Content-Encoding : aws-chunked,gzip"), and its example request signs it.

Compatibility notes:

• minio-go already sends and signs this header on the trailing-checksum path (request-signature-v4.go), so this extends an existing wire shape to plain-HTTP streaming uploads rather than introducing a new one. Conformant verifiers recompute the signature from received headers, so signatures stay valid.
• AWS documents that S3 stores the object without the aws-chunked encoding, and MinIO server strips it in trimAwsChunkedContentEncoding. A server that stores Content-Encoding verbatim would now echo aws-chunked in object metadata for plain-HTTP streaming PUTs, as it already does for trailing-checksum PUTs.

How to test this PR?

go test -race -count=1 ./pkg/signer/

Side-by-side results, master (802bd60) versus this PR:

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Optimization (provides speedup with no functional changes)
• Cleanup/Maintenance (no functional changes)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• Fixes a regression (If yes, please add commit-id or PR # here)
• Unit tests added/updated
• Internal documentation updated

Summary by CodeRabbit

• Bug Fixes
  • Improved AWS-chunked streaming uploads to preserve existing content encodings.
  • Prevented duplicate aws-chunked encoding values in request headers.
  • Updated signed and unsigned streaming requests for more consistent transfer handling.
• Tests
  • Added coverage for signed, unsigned, trailer-based, and multi-value content-encoding scenarios.