fix: reject unknown response-* query parameters in GetObject and HeadObject

getobject and headobject silently ignored any response-* query parameter outside the six overridable headers. they now return 400 InvalidArgument naming the parameter and its value, like s3, and the rest tests skipped for this issue are enabled.

Fixes #2075

s3api/utils/utils_test.go

@@ -1677,3 +1677,52 @@ func TestSetRegionMismatchHeader(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateResponseOverrides(t *testing.T) {
+	tests := []struct {
+		name  string
+		query string
+		want  error
+	}{
+		{"no query", "", nil},
+		{"no response override", "versionId=id&partNumber=1", nil},
+		{
+			"every overridable response header",
+			"response-cache-control=a&response-content-disposition=b&response-content-encoding=c&response-content-language=d&response-content-type=e&response-expires=f",
+			nil,
+		},
+		{
+			"unknown response header",
+			"response-fdsjkljj=dummy",
+			s3err.GetInvalidArgResponseOverride("response-fdsjkljj", "dummy"),
+		},
+		{
+			"unknown response header without a value",
+			"response-invalid",
+			s3err.GetInvalidArgResponseOverride("response-invalid", ""),
+		},
+		{
+			"bare prefix",
+			"response-=dummy",
+			s3err.GetInvalidArgResponseOverride("response-", "dummy"),
+		},
+		{
+			"unknown response header next to a valid one",
+			"response-content-type=text%2Fplain&response-invalid=dummy",
+			s3err.GetInvalidArgResponseOverride("response-invalid", "dummy"),
+		},
+		{
+			"first of several unknown response headers",
+			"response-one=1&response-two=2",
+			s3err.GetInvalidArgResponseOverride("response-one", "1"),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := fiber.New().AcquireCtx(&fasthttp.RequestCtx{})
+			ctx.Request().URI().SetQueryString(tt.query)
+
+			assert.Equal(t, tt.want, ValidateResponseOverrides(ctx))
+		})
+	}
+}