PII redaction fails from AWS CLI

The PII redaction succeeds when the S3 get is done from the console, as described in the corresponding tutorial. But from the AWS CLI it fails:

```
aws s3api get-object --bucket arn:aws:s3-object-lambda:us-west-2:012345678901:accesspoint/my-redacted-bucket-name --key pii-lambda-test/tutorial.txt /tmp/baz
```
The error is:
```
botocore.exceptions.ClientError: An error occurred (SignatureDoesNotMatch) when calling the GetObject operation: The request signature we calculated does not match the signature you provided. Check your key and signing method.
```

Debugging the lambda, I can see that the code is not correctly including `x-amz-` headers like `x-amz-checksum-mode` when calling the presigned URL. The issue doesn't happen from the console because it is not calculating a checksum on the payload, but other SDKs do. This is due to a logic error in `S3Client._filter_request_headers()`. I've tested a fix and will submit a PR.

Commencez dans S3Client._filter_request_headers() et reproduisez l’échec avec la commande AWS CLI indiquée dans l’issue. Vérifiez le traitement des en-têtes x-amz-, tels que x-amz-checksum-mode ; c’est terminé lorsque la requête avec la presigned URL inclut les en-têtes requis et que CLI GetObject ne déclenche plus d’erreur SignatureDoesNotMatch.

Rédigé par le modèle d'indexation à partir du texte de l'issue.