[rhnvrm]

Adds SSE-C support to simples3. Callers supply a raw 32-byte SSECustomerKey per operation; the library generates and signs the AES256, base64 key and key-MD5 headers.

• Covers PUT, GET, HEAD, form POST, copy with separate source/destination keys, and multipart uploads, including parallel uploads and completion.
• Adds SSECustomerHeaders for presigned requests and ExtraHeaders for multipart presigning. Key values remain outside URLs.
• Validates key length and incompatible encryption modes, requires HTTPS, and blocks key-bearing redirects to HTTP or another origin.
• Fixes SigV4 canonical header ordering: sorting complete name:value lines incorrectly ordered customer-key-md5 before customer-key. Headers now sort by name, with a regression test.
• Replays multipart retry payloads so retries retain the original content and SSE-C headers.
• Adds local TLS protocol tests and runs real SSE-C round trips against SeaweedFS in just test-local. A test-only TLS proxy forwards to the loopback HTTP fixture; direct remote integration requires HTTPS.

Rebased onto merged #53. CI uses SeaweedFS; no MinIO fixture changes remain in this PR.

Validation:

• Full suite passes under -race -count=1 in CI: https://github.com/rhnvrm/simples3/actions/runs/39761036542.
• The SSE-C integration test passes against real SeaweedFS: PUT/HEAD/GET, missing/wrong-key rejection, copy/rekey, parallel multipart, and presigned GET.
• Local protocol tests and go vet ./... pass.
• The two pre-existing integration skips remain (POST tagging and the optional presigned-header integration test).

Fixes #39.