feat(cli): expose transfer fidelity controls

[cxymds]

Closes rustfs/backlog#1461

Background

The core and S3 layers already model object attributes, tags, checksums, SSE-C, retention, legal hold, and explicit copy directives, but cp and pipe did not expose those capabilities consistently. cp --preserve was rejected even though metadata COPY is supported, and advanced policies could bypass the advanced transfer APIs on several execution paths.

Root cause

cp and pipe built narrow write options locally and selected advanced S3 APIs only for a subset of flags. This made local upload, remote copy, recursive copy, pipe, and multipart behavior diverge and left beta.10 capability boundaries implicit.

Solution

• add shared CLI parsing and validation for destination attributes, metadata, tags, SHA256, retention, and legal hold
• implement cp --preserve as explicit metadata COPY
• add metadata and tagging directive controls for remote copies
• route local uploads, pipe uploads, single copies, recursive copies, and multipart copies through advanced transfer options
• keep beta.10 gaps explicit before mutation: metadata REPLACE, remote tagging, remote checksum selection, server-side SSE-C copy, and multipart storage class
• keep dry-run secret-safe by avoiding SSE-C key loading and reporting policy names/counts only
• preserve existing JSON output schemas and protected contracts
• extend beta.10 smoke coverage so checksum, object-lock upload, and preserve copy run through CLI flags

Validation

• cargo fmt --all --check
• cargo clippy --workspace -- -D warnings
• cargo test --workspace
• integration feature test target compiles with cargo test -p rustfs-cli --test integration --features integration --no-run
• focused request-level tests cover local upload, pipe, single/recursive/multipart copy, dry-run, cancellation, UsageError, AccessDenied, checksum Conflict, UnsupportedFeature, and SSE-C redaction