feat: add server-side encryption support

Implements server-side encryption capabilities (v0.13.0) including:
- Core Support: SSE-S3 (AES256) and SSE-KMS
- Integration: Added encryption fields to UploadInput, CopyObjectInput, InitiateMultipartUploadInput, and MultipartUploadInput
- Operations: Updated FilePut, FileUpload (POST), CopyObject, and multipart upload flows to support encryption headers
- API: Updated FileDetails (HeadObject) to return ServerSideEncryption and SSEKMSKeyId in DetailsResponse

Testing:
- Configured MinIO with built-in KMS (via MINIO_KMS_SECRET_KEY) in docker-compose.yml to enable SSE-S3 support
- Added comprehensive integration tests verifying headers are correctly sent and returned
- Verified file integrity and encryption status across all upload methods

Updated ROADMAP.md to mark v0.13.0 as completed.

multipart.go

@@ -35,6 +35,11 @@ type InitiateMultipartUploadInput struct {
 	ContentType    string            // Optional: content type
 	CustomMetadata map[string]string // Optional: x-amz-meta-* headers
 	ACL            string            // Optional: x-amz-acl
+
+	// Optional: Server-side encryption (e.g. "AES256" or "aws:kms")
+	ServerSideEncryption string
+	// Optional: KMS Key ID (ARN or ID) when ServerSideEncryption is "aws:kms"
+	SSEKMSKeyId string
 }
 
 // InitiateMultipartUploadOutput contains the response from initiating a multipart upload
@@ -81,6 +86,14 @@ func (s3 *S3) InitiateMultipartUpload(input InitiateMultipartUploadInput) (Initi
 		req.Header.Set("x-amz-acl", input.ACL)
 	}
 
+	// Set server-side encryption
+	if input.ServerSideEncryption != "" {
+		req.Header.Set("x-amz-server-side-encryption", input.ServerSideEncryption)
+	}
+	if input.SSEKMSKeyId != "" {
+		req.Header.Set("x-amz-server-side-encryption-aws-kms-key-id", input.SSEKMSKeyId)
+	}
+
 	// Set custom metadata
 	for k, v := range input.CustomMetadata {
 		req.Header.Set(AMZMetaPrefix+k, v)
@@ -638,6 +651,11 @@ type MultipartUploadInput struct {
 	MaxRetries     int               // Optional: default 3
 	Concurrency    int               // Optional: default 1 (sequential)
 	OnProgress     ProgressFunc      // Optional: progress callback
+
+	// Optional: Server-side encryption (e.g. "AES256" or "aws:kms")
+	ServerSideEncryption string
+	// Optional: KMS Key ID (ARN or ID) when ServerSideEncryption is "aws:kms"
+	SSEKMSKeyId string
 }
 
 // MultipartUploadOutput contains the response from a multipart upload
@@ -682,11 +700,13 @@ func (s3 *S3) FileUploadMultipart(input MultipartUploadInput) (MultipartUploadOu
 
 	// Initiate multipart upload
 	initOutput, err := s3.InitiateMultipartUpload(InitiateMultipartUploadInput{
-		Bucket:         input.Bucket,
-		ObjectKey:      input.ObjectKey,
-		ContentType:    input.ContentType,
-		CustomMetadata: input.CustomMetadata,
-		ACL:            input.ACL,
+		Bucket:               input.Bucket,
+		ObjectKey:            input.ObjectKey,
+		ContentType:          input.ContentType,
+		CustomMetadata:       input.CustomMetadata,
+		ACL:                  input.ACL,
+		ServerSideEncryption: input.ServerSideEncryption,
+		SSEKMSKeyId:          input.SSEKMSKeyId,
 	})
 	if err != nil {
 		return MultipartUploadOutput{}, err