[Bug] COS STS default policy uses an invalid wildcard owner UID

### Search before asking

I searched the existing issues and found nothing similar.

### Fluss version

main (development)

### Please describe the bug

When Fluss obtains Tencent Cloud COS federation credentials without an explicitly configured `fs.cosn.userinfo.security_token_policy`, `COSSecurityTokenProvider` builds the default resource as:

```
qcs::cos::uid/*:/*
```

Tencent Cloud COS does not accept `uid/*` as the bucket owner segment for object access. The owner must be the bucket APPID, which is the numeric suffix of a standard COS bucket name. The generated temporary credentials are therefore accepted by STS but COS requests fail with HTTP 403.

Expected resource format:

```
qcs::cos::uid/:/*
```

This can be reproduced with a standard bucket such as `example-1250000000`: construct the provider without a custom policy, obtain the federation token, and access the configured remote-data prefix. STS returns credentials, but COS denies the operation because the resource owner is invalid.

No credentials, internal endpoints, or account identifiers are included in this report.

### Solution

Parse the numeric APPID suffix from the COS bucket name and use it in the default bucket-scoped policy. If the bucket name does not end in `-`, fail with an actionable message instructing the user to configure a custom policy rather than silently generating an unusable one. Add unit tests for both paths.

### Are you willing to submit a PR?

Yes, I will submit a PR with the fix and focused unit tests.

Start at COSSecurityTokenProvider and trace the default-policy path for a standard COS bucket name. Add the requested focused unit tests for the numeric APPID and invalid-suffix paths; done means the generated default resource uses the APPID and invalid names produce actionable custom-policy guidance.

Written by the indexing model from the issue text.