fix: reject unknown response-* query parameters in GetObject and HeadObject

getobject and headobject silently ignored any response-* query parameter outside the six overridable headers. they now return 400 InvalidArgument naming the parameter and its value, like s3, and the rest tests skipped for this issue are enabled.

Fixes #2075

s3api/controllers/object-head.go

@@ -61,6 +61,14 @@ func (c S3ApiController) HeadObject(ctx fiber.Ctx) (*Response, error) {
 		}
 	}
 
+	if err := utils.ValidateResponseOverrides(ctx); err != nil {
+		return &Response{
+			MetaOpts: &MetaOptions{
+				BucketOwner: parsedAcl.Owner,
+			},
+		}, err
+	}
+
 	// Validate that response override parameters are not used with anonymous requests
 	if hasResponseOverrides && isPublicBucket {
 		debuglogger.Logf("anonymous access is denied with response override params")