PII redaction fails from AWS CLI

The PII redaction succeeds when the S3 get is done from the console, as described in the corresponding tutorial. But from the AWS CLI it fails:

```
aws s3api get-object --bucket arn:aws:s3-object-lambda:us-west-2:012345678901:accesspoint/my-redacted-bucket-name --key pii-lambda-test/tutorial.txt /tmp/baz
```
The error is:
```
botocore.exceptions.ClientError: An error occurred (SignatureDoesNotMatch) when calling the GetObject operation: The request signature we calculated does not match the signature you provided. Check your key and signing method.
```

Debugging the lambda, I can see that the code is not correctly including `x-amz-` headers like `x-amz-checksum-mode` when calling the presigned URL. The issue doesn't happen from the console because it is not calculating a checksum on the payload, but other SDKs do. This is due to a logic error in `S3Client._filter_request_headers()`. I've tested a fix and will submit a PR.

Start in S3Client._filter_request_headers() and reproduce the failure with the AWS CLI command in the issue. Check the handling of x-amz- headers such as x-amz-checksum-mode; done means the presigned URL request includes the required headers and the CLI GetObject no longer raises SignatureDoesNotMatch.

Written by the indexing model from the issue text.