feat(admin): expose KMS key description and tag endpoints (#5575)

* feat(kms): add admin endpoints for key description and tag updates

Wire the KMS key metadata updates landed at the service layer to the admin
API: POST /v3/kms/keys/{update-description,tag,untag}. Each endpoint gates on
a dedicated KMS action scoped to the key its body names, records a handler-owned
audit entry for both the authorization denial and the outcome, and maps a
backend that cannot update key metadata to 501 rather than 404.

Refs rustfs/backlog#1586 (part of rustfs/backlog#1562)

* fix(admin): audit metadata attempts refused by an unavailable KMS

* test(admin): register the new KMS metadata routes in the matrix

crates/policy/src/policy/action.rs

@@ -724,6 +724,12 @@ pub enum KmsAction {
     DisableKeyAction,
     #[strum(serialize = "kms:RotateKey")]
     RotateKeyAction,
+    #[strum(serialize = "kms:UpdateKeyDescription")]
+    UpdateKeyDescriptionAction,
+    #[strum(serialize = "kms:TagResource")]
+    TagResourceAction,
+    #[strum(serialize = "kms:UntagResource")]
+    UntagResourceAction,
     #[strum(serialize = "kms:ListKeys")]
     ListKeysAction,
     #[strum(serialize = "kms:DescribeKey")]
@@ -771,6 +777,9 @@ mod tests {
             ("kms:EnableKey", KmsAction::EnableKeyAction),
             ("kms:DisableKey", KmsAction::DisableKeyAction),
             ("kms:RotateKey", KmsAction::RotateKeyAction),
+            ("kms:UpdateKeyDescription", KmsAction::UpdateKeyDescriptionAction),
+            ("kms:TagResource", KmsAction::TagResourceAction),
+            ("kms:UntagResource", KmsAction::UntagResourceAction),
             ("kms:ListKeys", KmsAction::ListKeysAction),
             ("kms:DescribeKey", KmsAction::DescribeKeyAction),
             ("kms:Decrypt", KmsAction::DecryptAction),