fix(sts): align AssumeRole authorization (#5281)

* fix(sts): align AssumeRole authorization with MinIO

* test(sts): cover AssumeRole OPA contract

* fix(iam): fail closed on unresolved policies

* fix(iam): fail closed while OPA initializes

---------

Co-authored-by: cxymds <cxymds@gmail.com>
Co-authored-by: Zhengchao An <anzhengchao@gmail.com>

rustfs/src/admin/handlers/sts.rs

@@ -183,7 +183,7 @@ async fn handle_assume_role(
             conditions: &conditions,
             is_owner: owner,
             claims: cred.claims_or_empty(),
-            deny_only: false,
+            deny_only: true,
             bucket: "",
             object: "",
         })