feat: add server-side encryption support

Implements server-side encryption capabilities (v0.13.0) including:
- Core Support: SSE-S3 (AES256) and SSE-KMS
- Integration: Added encryption fields to UploadInput, CopyObjectInput, InitiateMultipartUploadInput, and MultipartUploadInput
- Operations: Updated FilePut, FileUpload (POST), CopyObject, and multipart upload flows to support encryption headers
- API: Updated FileDetails (HeadObject) to return ServerSideEncryption and SSEKMSKeyId in DetailsResponse

Testing:
- Configured MinIO with built-in KMS (via MINIO_KMS_SECRET_KEY) in docker-compose.yml to enable SSE-S3 support
- Added comprehensive integration tests verifying headers are correctly sent and returned
- Verified file integrity and encryption status across all upload methods

Updated ROADMAP.md to mark v0.13.0 as completed.

object.go

@@ -42,8 +42,12 @@ type DetailsResponse struct {
 	Server        string
 	AmzID2        string
 	AmzRequestID  string
-	AmzMeta       map[string]string
-	ExtraHeaders  map[string]string
+	// Server-side encryption (e.g. "AES256" or "aws:kms")
+	ServerSideEncryption string
+	// KMS Key ID (ARN or ID) when ServerSideEncryption is "aws:kms"
+	SSEKMSKeyId string
+	AmzMeta     map[string]string
+	ExtraHeaders map[string]string
 }
 
 // UploadInput is passed to FileUpload as a parameter.
@@ -63,6 +67,11 @@ type UploadInput struct {
 	// Setting key/value pairs adds tags to the object (max 10 tags)
 	Tags map[string]string
 
+	// Server-side encryption (e.g. "AES256" or "aws:kms")
+	ServerSideEncryption string
+	// KMS Key ID (ARN or ID) when ServerSideEncryption is "aws:kms"
+	SSEKMSKeyId string
+
 	Body io.ReadSeeker
 }
 
@@ -187,6 +196,13 @@ func (s3 *S3) FilePut(u UploadInput) (PutResponse, error) {
 		req.Header.Set("x-amz-tagging", encodeTagsHeader(u.Tags))
 	}
 
+	if u.ServerSideEncryption != "" {
+		req.Header.Set("x-amz-server-side-encryption", u.ServerSideEncryption)
+	}
+	if u.SSEKMSKeyId != "" {
+		req.Header.Set("x-amz-server-side-encryption-aws-kms-key-id", u.SSEKMSKeyId)
+	}
+
 	req.ContentLength = fSize
 
 	if err := s3.renewIAMToken(); err != nil {
@@ -260,6 +276,14 @@ func (s3 *S3) FileUpload(u UploadInput) (UploadResponse, error) {
 		uc.MetaData["x-amz-tagging"] = encodeTagsHeader(u.Tags)
 	}
 
+	// Set server-side encryption
+	if u.ServerSideEncryption != "" {
+		uc.MetaData["x-amz-server-side-encryption"] = u.ServerSideEncryption
+	}
+	if u.SSEKMSKeyId != "" {
+		uc.MetaData["x-amz-server-side-encryption-aws-kms-key-id"] = u.SSEKMSKeyId
+	}
+
 	if err := s3.renewIAMToken(); err != nil {
 		return UploadResponse{}, err
 	}
@@ -445,6 +469,10 @@ func (s3 *S3) FileDetails(u DetailsInput) (DetailsResponse, error) {
 			out.AmzID2 = getFirstString(v)
 		case "x-amz-request-id":
 			out.AmzRequestID = getFirstString(v)
+		case "x-amz-server-side-encryption":
+			out.ServerSideEncryption = getFirstString(v)
+		case "x-amz-server-side-encryption-aws-kms-key-id":
+			out.SSEKMSKeyId = getFirstString(v)
 		default:
 			if strings.HasPrefix(lk, AMZMetaPrefix) {
 				if out.AmzMeta == nil {
@@ -493,6 +521,12 @@ type CopyObjectInput struct {
 	// Optional: Tags to set on the destination object (max 10 tags)
 	// When set, uses x-amz-tagging-directive: REPLACE
 	Tags map[string]string
+
+	// Optional: Server-side encryption (e.g. "AES256" or "aws:kms")
+	ServerSideEncryption string
+
+	// Optional: KMS Key ID (ARN or ID) when ServerSideEncryption is "aws:kms"
+	SSEKMSKeyId string
 }
 
 // CopyObjectOutput is returned by CopyObject.
@@ -566,6 +600,13 @@ func (s3 *S3) CopyObject(input CopyObjectInput) (CopyObjectOutput, error) {
 	// 	req.Header.Set("x-amz-tagging", encodeTagsHeader(input.Tags))
 	// }
 
+	if input.ServerSideEncryption != "" {
+		req.Header.Set("x-amz-server-side-encryption", input.ServerSideEncryption)
+	}
+	if input.SSEKMSKeyId != "" {
+		req.Header.Set("x-amz-server-side-encryption-aws-kms-key-id", input.SSEKMSKeyId)
+	}
+
 	// Sign the request
 	if err := s3.signRequest(req); err != nil {
 		return CopyObjectOutput{}, err