Add bucket policy, CORS, and encryption config to storage service

[NitinKumar004]

Summary

• Adds 8 new methods to storage driver interface: PutBucketPolicy, GetBucketPolicy, DeleteBucketPolicy, PutCORSConfig, GetCORSConfig, DeleteCORSConfig, PutEncryptionConfig, GetEncryptionConfig
• Adds 4 new types: BucketPolicy, PolicyStatement, CORSRule, CORSConfig, EncryptionConfig
• Implements across all 3 providers: AWS S3, Azure Blob Storage, GCP GCS
• Wires through portable API layer with metrics, recording, rate limiting, and error injection
• Get returns NotFound when no config is set (matches real cloud behavior)
• Delete is idempotent — sets config to nil

Closes #59

Test plan

Integration tests (cloudemu_test.go)

• TestBucketPolicyAWS — put, get, delete, verify NotFound after delete
• TestBucketPolicyAzure — put and get policy on Azure container
• TestBucketPolicyGCP — put and get policy on GCS bucket
• TestCORSConfigAWS — put, get, delete, verify NotFound after delete
• TestEncryptionConfigAWS — put and get encryption config
• TestEncryptionConfigAzure — put and get encryption config
• TestEncryptionConfigGCP — put and get encryption config

Verification

• Linter: 0 issues (golangci-lint run --timeout=9m ./...)
• Full test suite: all passing (go test ./...)