fix(s3): Add Content-MD5 header for DeleteObjects to fix AWS SDK v3.339.0+ compatibility

[skjnldsv]

Issue

AWS SDK PHP v3.339.0+ introduced a breaking change requiring the Content-MD5 header for DeleteObjects operations. This causes MissingContentMD5 errors (HTTP 400) when using S3-compatible services like MinIO or when strict compliance is enforced.

Related: aws/aws-sdk-php#3068

Solution

Add middleware to the S3Client handler list that automatically calculates and injects the Content-MD5 header on all DeleteObjects requests. This fix:

• Applies universally at the S3ConnectionTrait level, covering both external storage (AmazonS3) and core ObjectStore (S3) classes
• Uses AWS SDK's built-in Middleware API and Utils::hash() for MD5 calculation
• Checks for existing headers to avoid double-hashing (defensive)
• Only applies to DeleteObjects operations (query parameter = delete)

Changes

Modified files:

• lib/private/Files/ObjectStore/S3ConnectionTrait.php
  • Added imports: Aws\Middleware, GuzzleHttp\Psr7\Utils
  • Added addDeleteObjectsContentMd5Middleware() private method that appends middleware to calculate and inject the header
  • Called this method in getConnection() after S3Client instantiation, before bucket verification

New test file:

• tests/lib/Files/ObjectStore/S3ContentMd5MiddlewareTest.php
  • 7 unit tests covering:
    • Content-MD5 injection on DeleteObjects requests
    • Selective application (no injection for GET, PUT, HEAD, etc.)
    • Existing header preservation (idempotency)
    • MD5 calculation with various payload sizes
    • Base64 encoding validation
    • Empty body edge case
    • Middleware idempotency (no double-hashing)

[skjnldsv]

Tested locally on S3, it works.

[skjnldsv]

/backport to stable33 please

[skjnldsv]

/backport to stable32 please