fix(iam)!: split self-service password permissions and update SDK stack

[Vonng]

Separate self-service password changes from user administration in the existing AddUser endpoint: requests targeting the authenticated internal user check admin:ChangeMyPassword with explicit-Deny semantics; creation or password resets for other users still require admin:CreateUser.

Breaking authorization compatibility: the same saved policy can now authorize a previously denied password change. A Deny admin:CreateUser no longer locks the caller's password; add admin:ChangeMyPassword to that same statement before upgrading to preserve the old combined restriction. Conversely, an existing ChangeMyPassword deny is now enforced. The updated built-in readonly also drops its CreateUser deny, so it no longer overrides a separate user-administration grant. Saved overrides retain their original statements. Policies are not migrated automatically.

This is a deliberate permission-design change, independent of the minio-go SDK update. The migration guide documents the before/after matrix, wildcard and built-in policies, capability reporting, mixed-version rollout and rollback limits. Keep both denies during the rollout or rollback window if the old combined restriction must hold; an old Server does not enforce a password-only deny for this endpoint. The release containing this change must explicitly disclose it as breaking.

Coordinate the package, client and embedded Console dependencies:

• silo-pkg #6: merged commit 2d8fd3cbbf07, including upstream pkg Rename test-data to testdata, go will ignore it automatically minio/minio#262, consolereadonly from Make K,M to be uint8 and Technique becomes its own type minio/minio#233 and compatibility documentation
• mcli #41: merged commit e6a60edf0952
• Console #51: final source commit 6a0b31b5ade2, with dedicated password button/session permissions, rebuilt embedded assets and the same merged package/client pins
• Upstream minio-go 78bfa91607c2 (v7.3.1-0.20260909183557-78bfa91607c2), including server: Implement support for 'crossdomain.xml' flash requirement minio/minio#2301

Root, STS and service-account restrictions stay enforced.

Validation:

• Full Server GOWORK=off go test ./... -timeout=15m and coordinated workspace testing for the implementation; the final dependency-selection follow-up changes module pins and documentation without changing dependency runtime source
• GOWORK=off go test ./cmd -run 'TestIAMInternalIDPServerSuite|TestAPIUpstreamSDKStreamingContentType' -timeout=10m against the final source pins
• New streaming test verifies Content-Type is signed, accepted by SILO, preserved on the object, and rejected after header tampering
• IAM cases cover readonly/consolereadonly, legacy CreateUser deny, password-only grants, explicit/wildcard denies, other-user creation/resets, and old-password rejection
• Live embedded Console password changes, renewed sessions, failed old logins, successful new logins, denied users, and mcli S3 round trips
• The documentation follow-up is checked against the pre-split and current implementations and passes git diff --check; it changes no runtime code or dependency pins

The existing package/Console release gates remain pending; this is a coordinated source update, not a release or deployment. Upstream minio-go minio#2274 remains open and is absent from the pin; keep it as a non-blocking follow-up after upstream merge.