fix: drop the owner's FULL_CONTROL grant when grant headers set the bucket ACL

CreateBucket and PutBucketAcl with x-amz-grant-* headers stored the
requested grants plus a FULL_CONTROL grant for the bucket owner, so
GetBucketAcl returned a grant AWS doesn't. On AWS the headers replace the
whole ACL and the owner gets FULL_CONTROL only when a header names it.

UpdateACL now keeps just the header grants when there are any. A canned
ACL and a bucket created without grants still get the owner's FULL_CONTROL
grant. The owner keeps full access either way, since aclAllows lets the
bucket owner perform any action regardless of grants.

Fixes #1407

tests/integration/CreateBucket.go

@@ -212,13 +212,6 @@ func CreateBucket_non_default_acl(s *S3Conf) error {
 	}
 
 	grants := []types.Grant{
-		{
-			Grantee: &types.Grantee{
-				ID:   &s.awsID,
-				Type: types.TypeCanonicalUser,
-			},
-			Permission: types.PermissionFullControl,
-		},
 		{
 			Grantee: &types.Grantee{
 				ID:   &testuser1.access,