silo-pkg v3.16.1

silo-pkg v3.16.1 hardens strict IAM and bucket policy JSON decoding and updates the Go 1.27.4 dependency baseline while preserving public package APIs and valid policy semantics. Consumers require Go 1.27.4.

• Reject non-object JSON inputs, trailing tokens, and unknown top-level, statement, or principal fields in policy.ParseConfigStrict and policy.ParseBucketPolicyConfig so custom UnmarshalJSON decoders cannot turn misspelled fields into empty policies or drop statement conditions.
• Require Go 1.27.4 and update the matching CI baseline.
• Upgrade golang.org/x/sys to v0.50.0, golang.org/x/term to v0.48.0, golang.org/x/text to v0.44.0, golang.org/x/oauth2 to v0.38.0, grpc-gateway/v2 to v2.33.0, google.golang.org/grpc to v1.85.0, and go-humanize to v1.1.0.
• Preserve the verified x/crypto and minio-go commits, terminal widths, and the go-systemd v22.6.0 NetBSD portability replacement.

This is a source-only Go module release, with no binary or container image. Server, Console and mcli must adopt v3.16.1 and rebuild independently.

go get github.com/pgsty/silo-pkg/v3@v3.16.1
go mod tidy

Validation: full lint and race tests, live LDAP CI, module verification and tidy checks, and govulncheck across all packages.

Release source: 433f7eefa714a30b72ca70c4dffcd5faca25804f.

• Go CI
• LDAP CI
• VulnCheck
• Changes since v3.16.0