objects: force UnsignedPayload for S3 uploads (phoebe-lab patch)

Carried production patch from the phoebe-lab SourceHut deployment
(patches/core-go-checksum.patch). Fixes streaming PutObject to a
non-AWS S3 backend (Garage) over plain HTTP, where the AWS SDK's
dynamic payload middleware only uses UnsignedPayload over HTTPS and
otherwise falls through to ComputePayloadSHA256, which seeks the
non-seekable request body (pages Publish tarball, builds artifact
stream) and fails. Force UnsignedPayload unconditionally and pin the
sigv4 signing region so the endpoint resolver does not reset it.

Not upstreamed.

objects: make `URL()` respect `s3-insecure`

Helpful in development environments where a local S3 instance is used
without HTTPS.

Don't uppercase error messages

objects: bring back support for plain HTTP

This got lost during the transition from minio to S3 client.

objects: improve support for our s3 deployment

Not sure how well this generalizes but we can improve it when someone
complains.

Switch from minio to AWS SDK S3 client

Moves s3 => objects to avoid conflicting with the AWS module.