fix(iam): serialize replicated identity updates

[GatewayJ]

Related Issues

Depends on rustfs#5152. This is a stacked PR in GatewayJ/rustfs, based on fix/oidc-service-account-policy; GitHub cannot use a fork branch as the base of an upstream PR.

Summary of Changes

• Replace a replicated service account's complete authorization state instead of retaining receiver claims or groups.
• Add conditional IAM identity writes backed by object ETags, replicated service-account tombstones, serialized identity cache mutations, and three-way full-reload cache merging.
• Fence stale replicated create, update, and delete events by source revisions.
• Exercise the real site-replication IAM handler for an OIDC service-account update, including claims, groups, secret, status, description, policy, and revision replacement.

Verification

• cargo test -p rustfs replicated_oidc_service_account_replaces_claims_and_groups_in_handler --lib
• cargo fmt --all --check
• make pre-commit
• make pre-pr

Impact

No S3 protocol, public API, or configuration change. IAM service-account deletion now persists an internal tombstone so delayed replication cannot restore the deleted access key. Non-object Store implementations retain legacy unconditional-write behavior through trait defaults.

The change affects site-replication IAM persistence only. Deploy it to every participating site before relying on tombstone-based stale-delete protection. Parent-user deletion remains unchanged; its cross-node atomicity needs a separate design.

Additional Notes

High-risk adversarial review: correctness (full replacement and stale-event tests), simplicity (reuse of the existing IAM object precondition interface), security (no stale privileged claims survive), concurrency/durability (ETag CAS, bounded retries, and serialized cache commits), compatibility (no S3 wire change), performance (infrequent IAM mutation path only), and test coverage found no unresolved issue.