feat: add support for S3 SSE-C (customer-provided encryption keys)

[schaurian]

Summary

Adds support for S3 Server-Side Encryption with Customer-provided keys (SSE-C) to the barman-cloud library.

A new optional sseCustomerKey field on S3Credentials references a secret holding a base64-encoded 256-bit AES key. When set, the key is materialized to a file and passed to every barman-cloud command via the --sse-customer-key file:// option.

This is the library-side change needed to close cloudnative-pg/plugin-barman-cloud#646 — S3-compatible providers such as Hetzner Object Storage only support SSE-C for encryption at rest, so the existing bucket-managed encryption field (SSE-S3 / SSE-KMS) cannot be used with them.

What changed

File	Change
pkg/api/config.go	New SSECustomerKey *SecretKeySelector field on S3Credentials (+ generated deepcopy)
pkg/utils/constants.go	SSECustomerKeyFileLocation — the on-disk path for the materialized key
pkg/credentials/env.go	Materialize/remove the key file from the referenced secret (same pattern as the Google credentials file)
pkg/command/commandbuilder.go	Inject --sse-customer-key file://… in the shared appendCloudProviderOptions
pkg/command/commandbuilder_test.go	Unit tests for the AWS SSE-C option

Design notes

• Single injection point. The flag is added in appendCloudProviderOptions, through which every command builder already routes (barman-cloud-backup, -wal-archive, -wal-restore, -restore, -backup-list, -backup-delete, -check-wal-archive). SSE-C requires the key on every read and write, so covering the shared chokepoint avoids the classic "backups succeed but restores fail because a read path was missed" footgun.
• Key materialization mirrors the existing Google credentials handling (reconcileGoogleCredentials → a /controller/... file written atomically with 0600), so no new volume-mount plumbing is needed in consumers; the same code path serves both the operator and the plugin sidecar.
• Orthogonal to encryption. SSE-C (customer key) and SSE-S3/SSE-KMS (bucket-managed) are independent mechanisms; this field does not touch the existing encryption option.
• Auth-method independent. The key is materialized before the auth branching in envSetAWSCredentials, so it works with explicit keys, session tokens, and inheritFromIAMRole.

Dependency / rollout

Runtime use requires a barman release that ships the --sse-customer-key option (EnterpriseDB/barman#973, merged to master). This Go change is valid and tested independently of that release; the plugin can adopt it once both are released. A follow-up PR wires the field into plugin-barman-cloud.

Testing

• go build ./..., go vet ./pkg/... — clean
• go test ./pkg/... — passing (new AWS SSE-C option specs added)
• gofmt / gofumpt / gci — clean

🤖 Generated with Claude Code