fix(security): add deny_unknown_fields to deserialization structs (#3198)

* fix(security): add deny_unknown_fields to deserialization structs

Prevent silent acceptance of malformed or adversarial payloads.

- policy: Policy, BucketPolicy, Statement, BPStatement, PrincipalObject
- notify: S3KeyFilter custom deserializer rejects unknown child elements
- update: VersionInfo (remote HTTP response)

26 policy + 82 notify tests pass.

* fix(update): keep version response forward compatible

---------

Co-authored-by: houseme <housemecn@gmail.com>

crates/notify/src/rules/xml_config.rs

@@ -207,7 +207,7 @@ impl<'de> Deserialize<'de> for S3KeyFilter {
                             self.filter_rules = s3key_content.get_filter_rules();
                         }
                         _ => {
-                            map.next_value::<serde::de::IgnoredAny>()?;
+                            return Err(serde::de::Error::unknown_field(&key, &["S3Key"]));
                         }
                     }
                 }