change bucket policy schema to fit AWS json

[nadavMiz]

Explain the changes

1. change bucket policy schema to match AWS schema, according to what we currently support. passing the json as is from the request
2. change all calling functions to use correct arguments.
3. add an upgrade script for the bucket policy
4. add unit tests for upgrade script

Issues: Fixed #xxx / Gap #xxx

1. gap - anyOf schema changes aren't dealt by decode_json / encode_json functions. since we only use string and sensitiveString in our case it works fine. issue: decode_json / encode_json functions should work with oneOf / anyOf schema options  #7448

Testing Instructions:

• Doc added/updated
• Tests added

[aspandey]

Looks good to me. I observe that most of the changes are related to lower case to upper case. We need to make sure that this does not break other code wherever it might be using lowercase.

[romayalon]

I recall we didn't support anyOf/oneOf in postgresClient encode_json/decode_json, @dannyzaken is this valid now?

[romayalon]

@dannyzaken ?

[dannyzaken]

I guess you're right. this can be an issue since the values underneath are SensitiveString and will probably not be unwrapped properly when stored. @nadavMiz how does it look in the DB when you store a policy?

in general we should probably handle it. I think there are other places we use anyOf/oneOf that are stores in the DB

[nadavMiz]

@dannyzaken @romayalon

in the database the prefix appears clearly in all case:

{"_id": "64ca177180d3ca00289e9937", "tag": "", "name": "first.bucket", "system": "64ca177180d3ca00289e992f", "tiering": "64ca177180d3ca00289e9936", "s3_policy": {"Version": "20
12-10-17", "Statement": [{"Action": ["s3:PutBucketPolicy", "s3:*"], "Effect": "Allow", "Resource": ["arn:aws:s3:::first.bucket"], "Principal": {"AWS": "*"}}, {"Action": ["s3:PutObject"], *"Effect": "Allow"
, "Resource": ["arn:aws:s3:::first.bucket/*"], "Principal": "*"}, {"Sid": "id-1", "Action": ["s3:GetObject"], "Effect": "Allow", "Resource": ["arn:aws:s3:::first.bucket/*"], "Principal": {"AWS": ["nadav",
 "*"]}}]}, "versioning": "DISABLED", "last_update": 1690977631534, "master_key_id": "64ca177180d3ca00289e9938", "owner_account": "64ca177180d3ca00289e992e", "storage_stats": {"pools": {}, "blocks_size": 0
, "last_update": 1690977537545, "objects_hist": [], "objects_size": 0, "objects_count": 0, "chunks_capacity": 0, "stats_by_content_type": []}, "lambda_triggers": []}

also in logs we print for bucket policy we get the prefix is a sensitive string. for example in policy validation:

principal fit? SENSITIVE-7846cdd4c2b90527 nadav

looks like it is fine in this case

[romayalon]

As we discussed, this anyOf doesn't really gets encoded, but since all we have inside the any of is string/sensitive string it works.
@dannyzaken Are you ok with merging it and opening a gap for the anyOf issue?

[nadavMiz]

opened an issue for the anyOf: #7448

[dannyzaken]

I'm fine with the gap.