refactor: extract shared S3 client config into global config block

[alecthomas]

Pull S3 connection config (endpoint, region, SSL settings) and minio
client construction out of the S3 cache backend into a new s3client
package, following the same pattern as gitclone.Config/ManagerProvider.

• Add internal/s3client with Config, ClientProvider, and NewClient
• Config is an optional HCL block in GlobalConfig
• ClientProvider lazily constructs a singleton *minio.Client
• NewClient verifies connectivity via ListBuckets up front
• S3Config retains only cache-specific fields (bucket, TTL, upload tuning)
• RegisterS3/NewS3 accept a ClientProvider parameter
• Move minitest to s3client/s3clienttest with deterministic per-package
  bucket names derived from runtime caller inspection, cleaning stale
  objects up front and via t.Cleanup

Example config:

s3 {
  endpoint       = "s3.amazonaws.com"
  region         = "us-west-2"
  use-ssl        = true
  skip-ssl-verify = false
}

cache s3 {
  bucket            = "my-cache-bucket"
  max-ttl           = "1h"
  upload-concurrency = 4
  upload-part-size-mb = 16
}