Files.S3: default UsePublicReadAcl to false

`Files:S3:UsePublicReadAcl` defaults to `true` (`BarakoCMS.Files.S3/S3StorageOptions.cs:46`), while the module README calls `false` the safer default and tells people to set it on every provider it lists.

A new AWS bucket has Object Ownership set to bucket owner enforced, which refuses ACLs, so with the default a public upload to a freshly created bucket is refused. R2, SeaweedFS and Garage ignore or refuse the ACL too. The only setup that needs `true` is an AWS bucket with ACLs turned back on.

## Change

Default `UsePublicReadAcl` to `false` in 5.0.0.

Not before: CLAUDE.md section 3 says a default must preserve existing behaviour, and a deployment on an ACL-enabled bucket that never set the flag would stop getting public-read objects on upgrade. Until then the README keeps saying to set `false`.

## Done when

- `S3StorageOptions.UsePublicReadAcl` is `false` by default, with a test that reads the default.
- The upgrade notes for 5.0 name the flag and say to set `true` only for an ACL-enabled AWS bucket.
- A `Changed` changelog fragment says the same.

Start at BarakoCMS.Files.S3/S3StorageOptions.cs:46 and inspect the existing option default and related tests. Update the default, add a test that reads it, then update the module README, 5.0 upgrade notes, and the Changed changelog fragment; done means all three documentation items explain that true is only for ACL-enabled AWS buckets.

Written by the indexing model from the issue text.