Merge the Express live probes, shrink the stage cases, simplify the proxy, and add session expiration

[tiptenbrink]

Summary

• Live probes. cases/s3-express-live.json merges into cases/live.json under the s3-express profile, as s3-express.json merged into operations.json in Mirror cases onto HNS and S3 Express, and merge s3-express.json into operations #7. The two probes and their ids are unchanged.

• Smaller stage cases. operations/s3/stage and operations/s3-express/stage uploaded a 5 MiB part, carried twice as base64 in each case. They made up 28 of the 34 MB of cases/operations.json. They now upload the four-byte part the key-encoding stage cases already use: S3 takes a part of any size, and refuses a small part only when a completion names it before another part. Both cases were verified live again. cases/operations.json is now 6 MB.

• Proxy tunnels. The grader's loopback proxy now answers CONNECT and reads the request inside the tunnel. ureq opens such a tunnel even to an http:// target, and the grader refused it. Every grader target is plain HTTP, so the tunnel carries the request unchanged, and the case checks its Host header as before.

• Proxy from the environment. An offline adapter also finds the grader's proxy in HTTP_PROXY and http_proxy. ureq and the AWS CRT read their proxy from there by default, so an adapter built on them needs no proxy code. The grader clears every other inherited proxy variable for an offline adapter, so it reaches only the grader, and leaves a live adapter's environment as it is.

• Session expiration. A response may carry body_time, {"text": "SESSION_EXPIRATION", "offset_seconds": 300}: the grader replaces that text in the body with the time that many seconds after it sends the response, in ISO 8601 UTC. Every S3 Express CreateSession answer now carries its Expiration this way, five minutes ahead and in the element order S3 writes, as measured live. The new operations/s3-express/get-session-expired answers the first CreateSession with a session that expired a minute ago: a client must ask again and sign its GET with the second session. The AWS C++ SDK uses the expired one.

For clients

• live cases/live.json ENDPOINTS --provider s3 now selects the Express probes too, and needs an s3-express endpoint for them. Use --profile s3 or --profile s3-express to run one.

• An adapter behind proxy_url may use a CONNECT tunnel or absolute-form requests.

• A client that misreads Expiration and renews a valid session sends a CreateSession no Express case expects.

Test plan

• cargo test --locked, cargo clippy --locked --all-targets -- -D warnings and cargo fmt --check pass.
• object-tests validate passes for cases/live.json (6 cases) and cases/operations.json (916 cases).