feat(admin): add bulk access-key inspection

[cxymds]

Summary

• add rc admin access-key ls for bounded, typed bulk inspection across builtin, LDAP, and OpenID identities
• require exact per-provider capability advertisement and fail closed for missing, disabled, stubbed, unknown, or denied capabilities
• batch up to 1,000 selectors, bound responses to 8 MiB / 10,000 records, and provide deterministic offset/limit pagination
• classify service-account and STS keys without retaining secret keys, session tokens, unknown fields, or raw server errors
• preserve per-provider and per-selector failures with stable aggregate exit-code semantics

BREAKING contract update

The protected command reference and output-v3 schema are extended with the new iam_access_keys family. Existing command behavior and existing output families remain backward compatible.

Validation

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• targeted access-key unit tests (11)
• crates/cli/tests/admin_access_key_bulk.rs E2E tests (2)
• git diff --check

Known limits

Pagination is deterministic over each bounded server response but is not a cross-command transactional snapshot if IAM state changes between invocations. Future server versions without an explicit capability contract remain fail closed.

Closes rustfs/backlog#1495
Refs rustfs/backlog#1380