Update Cactus to current mainline and use one true source of Cactus

[adamnovak]

Changelog Entry

To be copied to the draft changelog by merger:

• Toil is now tested against a more current Cactus
• Toil now enables server-side encryption with customer-provided keys (SSE-C) on job store AWS buckets, so it can use it

Reviewer Checklist

• Make sure it is coming from issues/XXXX-fix-the-thing in the Toil repo, or from an external repo.
  • If it is coming from an external repo, make sure to pull it in for CI with:

    contrib/admin/test-pr otheruser theirbranchname issues/XXXX-fix-the-thing
    

  • If there is no associated issue, create one.
• Read through the code changes. Make sure that it doesn't have:
  • Addition of trailing whitespace.
  • New variable or member names in camelCase that want to be in snake_case.
  • New functions without type hints.
  • New functions or classes without informative docstrings.
  • Changes to semantics not reflected in the relevant docstrings.
  • New or changed command line options for Toil workflows that are not reflected in docs/running/{cliOptions,cwl,wdl}.rst
  • New features without tests.
• Comment on the lines of code where problems exist with a review comment. You can shift-click the line numbers in the diff to select multiple lines.
• Finish the review with an overall description of your opinion.

Merger Checklist

• Make sure the PR passed tests, including the Gitlab tests, for the most recent commit in its branch.
• Make sure the PR has been reviewed. If not, review it. If it has been reviewed and any requested changes seem to have been addressed, proceed.
• Merge with the Github "Squash and merge" feature.
  • If there are multiple authors' commits, add Co-authored-by to give credit to all contributing authors.
• Copy its recommended changelog entry to the Draft Changelog.
• Append the issue number in parentheses to the changelog entry.

[adamnovak]

I had to implement enabling SSE-C now that Amazon has blocked it by default for us, to fix failing CI tests.

I also revised the handling of bucket public object support, because it didn't look like we really needed it to be on by default for anything but job stores.

[adamnovak]

Now it's failing because we're on Python 3.14, and pysam hasn't yet released a release with 3.14 wheels (pysam-developers/pysam#1364), so it tries to build pysam. But pysam can't build without a bunch of dev libraries we don't ship in the Toil container.

I guess pysam is important enough to Toil users that it might make sense to ship the dependencies needed to build it when there's no wheel?