fix: reject uploads with uploadId for every bucket and object operation

Requests carrying both the uploads and uploadId query parameters were
only rejected for a bucket GET, so DELETE, PUT, POST and HEAD on the
bucket or object paths still ran real operations. S3 rejects the
combination for every method on both paths, before authentication and
before checking that the bucket exists.

Register the error route for all methods on the bucket and object
routers right after the CORS middleware is set up, ahead of every other
route, and cover each method and path with an integration test.

s3api/router.go

@@ -102,6 +102,17 @@ func (sa *S3ApiRouter) Init() {
 	objectRouter := sa.app.Group("/:bucket/*")
 	applyBucketCORS := middlewares.ApplyBucketCORS(sa.be, middlewares.BucketFromPath, sa.corsAllowOrigin)
 
+	// '?uploads' together with '?uploadId' is rejected for every
+	// bucket and object operation
+	for _, method := range []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPost, http.MethodDelete} {
+		for _, router := range []fiber.Router{bucketRouter, objectRouter} {
+			router.Add([]string{method}, "",
+				middlewares.MatchQueryArgs("uploads", "uploadId"),
+				controllers.ProcessHandlers(ctrl.HandleErrorRoute(s3err.GetInvalidArgumentErr(s3err.InvalidArgUploadIdWithUploads, "uploadId")), metrics.ActionUndetected, services),
+			)
+		}
+	}
+
 	// PUT bucket operations
 	bucketRouter.Put("",
 		middlewares.MatchQueryArgs("tagging"),
@@ -725,11 +736,6 @@ func (sa *S3ApiRouter) Init() {
 			middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, false, false),
 			middlewares.ParseAcl(sa.be),
 		))
-	// bucket operation with both '?uploads' and '?uploadId' is rejected
-	bucketRouter.Get("",
-		middlewares.MatchQueryArgs("uploads", "uploadId"),
-		controllers.ProcessHandlers(ctrl.HandleErrorRoute(s3err.GetInvalidArgumentErr(s3err.InvalidArgUploadIdWithUploads, "uploadId")), metrics.ActionUndetected, services),
-	)
 	bucketRouter.Get("",
 		middlewares.MatchQueryArgs("uploads"),
 		controllers.ProcessHandlers(