Restrict CI to require put-if-none-match

For the cases where we expect writers to only write once -- probably at least:

• rust-lang/rust CI uploads
• mirror bucket (maybe, not sure about this one)
• crates.io crate uploads (maybe)

We should update the CI code and then update the AWS policies to enforce CI is only creating new objects, not overwriting old ones. See docs here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/conditional-writes-enforce.html

That would deliver part of the security benefit from https://github.com/rust-lang/simpleinfra/pull/355#discussion_r1368296539, where we prevent accidental or intentional overwrites of already created objects -- making it noisy if someone e.g. queues up writes from a try build to a different try build or similar, rather than silently succeeding in both builds (as would happen today). It's not a complete fix since it's time dependent, but for auto merges it's already fully sufficient (those never run concurrently) and for try builds it at least helps somewhat.

Start by locating the CI upload code and AWS policies for Rust CI uploads, the mirror bucket, and crates.io crate uploads. Read the AWS conditional-writes guidance and the linked security discussion; done means the agreed writer cases require new-object-only writes and the policies enforce that behavior.