object-store: support for client-side encryption on S3

On S3 when objects are [client-side encrypted](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingClientSideEncryption.html) the [encryption metadata is stored and transmitted through headers](https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/services/s3/package-summary.html#:~:text=S3%201st%20gen%20crypto%20meta,time%20randomly%20generated%20data%20key) on GET and HEAD requests, which is required to decrypt objects on the client-side.

Currently the `ObjectMeta` does not support provider-specific metadata although it's already able to extract it from request headers.

**Describe the solution you'd like**
The minimal change would be to passthrough S3-specific client-side encryption metadata through the `ObjectMeta`, which could then by used by client.

**Describe alternatives you've considered**
The better solution would be to support content decryption within the library itself, however it would create dependencies on `openssl` or similar and add considerable amount of logic, which might limit the types of clients who would be able to use this library.

**Additional context**
I'm willing to author the change, but need guidance on the design.

Start by tracing how S3 GET and HEAD request headers are extracted into ObjectMeta. Review the existing provider-specific metadata handling and the linked AWS client-side encryption header documentation. Done means the relevant S3 encryption metadata is passed through ObjectMeta for clients without adding decryption logic.

Written by the indexing model from the issue text.