Add opt-in decryption fallback

[louisgls]

Summary

• add an opt-in S3PROXY_DECRYPTION_FALLBACK path for GET object decryption
• retry only DEK unwrap/decryption metadata path after the primary KEK fails; payload decryption still happens once on the successful path
• expose generic Helm extraEnv instead of a dedicated fallback chart value
• add configurable Deployment strategy (RollingUpdate by default, supports Recreate)
• document the new Helm values and add regression coverage

Usage

extraEnv:
  - name: S3PROXY_DECRYPTION_FALLBACK
    value: "true"

deploymentStrategy:
  type: Recreate

Validation

• go test ./...
• golangci-lint run
• CGO_ENABLED=0 GOOS=linux go build -o /tmp/s3proxy-decryption-fallback ./s3proxy/cmd
• helm template test charts/s3proxy
• helm template test charts/s3proxy --set deploymentStrategy.type=Recreate --set-string extraEnv[0].name=S3PROXY_DECRYPTION_FALLBACK --set-string extraEnv[0].value=true