feat(iam): tri-state, unknown-resource and service-wide policy evaluation

[NitinKumar004]

Part a of tracker AUTHZ-X1 (IAM authorization for query and REST requests).

What

Adds an optional AWS-only capability PermissionEvaluator to services/iam/driver, next to ContextualAuthorizer and PolicyInspector:

• EvaluatePermission(ctx, EvalRequest) Decision returns allowed, implicitDeny or explicitDeny.
• EvaluateServiceWide(ctx, principal, service, condCtx) Decision answers "may this principal run every svc: action on every resource".

In providers/aws/iam, decide becomes a wrapper over decideWith(docs, req, mode) with three modes:

• Known resource. Same evaluation as before (evaluatePolicy per document).
• Unknown resource. An Allow counts only when its Resource list holds "*"; a NotResource Allow never counts. A Deny that matches the action counts whatever its Resource or NotResource. A condition key missing from the context makes a Deny match and an Allow fail. The Deny half is a deliberate fail-closed deviation from real IAM (commented in evaluatePolicyConservative): with the resource unknown we can't prove the Deny doesn't apply.
• Service-wide. An Allow counts when an Action entry matches the literal svc:* (*, s3:*, s* do, s3:Get* doesn't) on Resource "*", or when no NotAction entry could match svc. A Deny counts when any Action entry could match a svc: action, or when its NotAction doesn't cover all of svc:*.

The permissions boundary is evaluated in the same mode, and an explicit Deny in either the identity policies or the boundary gives explicitDeny.

condition.go gains evaluateConditionsWith with an absent-key rule; evaluateConditions keeps real IAM semantics.

Why

The enforce-auth gate only authorizes JSON-RPC requests today. X1b (next) needs a tri-state answer, a safe answer when the handler can't name the resource yet, and a service-level answer for handlers that are still at tier 0. EvaluatePermission and EvaluateServiceWide have no production caller in this PR; X1b is their first consumer, as the plan sequences.

Unchanged

CheckPermission and CheckPermissionWithContext return exactly what they did. CheckPermissionWithContext now goes through the shared evaluatePrincipal helper in known-resource mode. Tests pin known mode against a copy of the old decide loop over a corpus of documents, actions, resources and contexts, and the existing IAM and server/aws authz suites pass as they are. No wire or gate change.

Tests

providers/aws/iam/evaluate_modes_test.go: every mode, the conservative Deny cases (missing key, AND with a present key, IfExists Allow), NotAction and NotResource in each mode, boundary in each mode, group Deny beating a user Allow, and CheckPermission agreement.