fix(site-replication): use MinIO-compatible sts-account IAM item type (#5750)

* test(site-replication): expect MinIO sts-account IAM item type

MinIO madmin-go replicates STS credentials with SRIAMItem type
"sts-account" (SRIAMItemSTSAcc), but RustFS emits and accepts only
"sts-credential", so cross-implementation STS replication fails in
both directions (MinIO returns errSRInvalidRequest, RustFS returns
NotImplemented).

Red-light tests:
- pin the outbound AssumeRole replication item type to "sts-account"
  (construction extracted into assume_role_site_replication_item so it
  is testable, behavior unchanged in this commit)
- update the federated identity replication item snapshot to
  "sts-account"
- inbound apply_iam_item must dispatch both "sts-account" and the
  legacy "sts-credential" alias to the STS arm instead of the
  unknown-type NotImplemented fallback

* fix(site-replication): use MinIO-compatible sts-account IAM item type

MinIO madmin-go replicates STS credentials with SRIAMItem type
"sts-account" (SRIAMItemSTSAcc). RustFS emitted "sts-credential" and
accepted only that value inbound, so STS credential replication with
MinIO peers failed in both directions: MinIO rejected RustFS items as
errSRInvalidRequest and RustFS answered MinIO items with
NotImplemented.

- define SR_IAM_ITEM_STS_ACC ("sts-account") and
  SR_IAM_ITEM_STS_ACC_LEGACY ("sts-credential") in rustfs-madmin
- emit "sts-account" from both outbound sites (AssumeRole hook and
  federated identity OIDC hook)
- accept both types inbound; the legacy alias remains permanently for
  mixed-version RustFS rolling upgrades

Token verification and the retry/event mechanism are unchanged.

crates/madmin/src/site_replication.rs

@@ -21,6 +21,15 @@ use time::OffsetDateTime;
 
 pub const SITE_REPL_API_VERSION: &str = "1";
 
+/// `SRIAMItem` type for replicated STS credentials, matching MinIO madmin-go
+/// `SRIAMItemSTSAcc`. MinIO peers reject any other value as an invalid request.
+pub const SR_IAM_ITEM_STS_ACC: &str = "sts-account";
+
+/// STS item type emitted by RustFS releases prior to the MinIO alignment.
+/// Never emitted anymore, but accepted inbound permanently so mixed-version
+/// RustFS sites keep replicating STS credentials during rolling upgrades.
+pub const SR_IAM_ITEM_STS_ACC_LEGACY: &str = "sts-credential";
+
 #[derive(Clone, Serialize, Deserialize, Default)]
 pub struct PeerSite {
     #[serde(default)]