test: reproduce opendal 0.58's S3/ADLS credential-ignoring regressions

[gbrgr]

Regression coverage for two related production incidents found while
validating the RustyIceberg 0.9.2 bump in raicode
(raicode#28144).

S3: s3.allow-anonymous ignores configured credentials

raicode's Iceberg data-loading integration always sends
"s3.allow-anonymous" => "true" alongside any explicit credentials,
intending it purely as a fallback for when no credentials are configured.

Under the fork's old opendal (0.55, pre RelationalAI/iceberg-rust#78),
that was safe: allow_anonymous was only consulted after trying to load
a real credential, and only skipped signing if none was found
(opendal-0.55.0/src/services/s3/core.rs, S3Core::load_credential).

Upstream's opendal 0.58 renamed the flag to skip_signature and changed
its semantics: it's now checked first, unconditionally, before any
credential is even loaded (opendal-service-s3-0.58.2/src/core.rs:
if self.skip_signature { return ...unsigned... }). So configured
credentials are silently ignored whenever allow-anonymous is also set —
every request now goes out unsigned, which a private bucket correctly
rejects with 403 AccessDenied / AUTH_FAILED.

Verified locally against this repo's own docker-compose MinIO: 14/14
pass, including both new assertions (allow-anonymous + valid credentials
→ AUTH_FAILED; allow-anonymous omitted with the same credentials →
success).

ADLS: no anonymous-access mode existed at all

Unlike S3's opendal service, opendal's Azdls service had no anonymous/
unsigned mode: every request went through a generic credential-provider
chain that hard errors ("failed to load signing credential") if no
credential can be found or validated. An empty adls.sas-token doesn't
help either — it's treated as a found-but-invalid credential, which
fails the same way. So reading a genuinely public, unauthenticated Azure
container wasn't possible through this stack at all.

RelationalAI/iceberg-rust#79
adds an explicit "adls.allow-anonymous" opt-in (mirroring
s3.allow-anonymous), routing to opendal's generic Http service
(plain unauthenticated GET/HEAD) instead of the signed Azdls one.

Verified against the real public Azure test container
(publicbenchmarks.dfs.core.windows.net/integration-tests, the same
one raicode's own integration tests read from): without the flag,
table_open correctly fails with AUTH_FAILED; with it, the read
succeeds. Local run: 17/17 pass in the same testset.

Status

• iceberg/iceberg-catalog-rest currently point at
  RelationalAI/iceberg-rust#79's branch tip for this verification —
  needs a follow-up bump to the actual merge commit once that PR
  lands (flagged with a TODO in Cargo.toml).
• Version bumped 0.9.2 → 0.9.3 to match.

🤖 Generated with Claude Code