feat: support S3 SSE-C (customer-provided encryption keys)

[schaurian]

Summary

Adds support for S3 Server-Side Encryption with Customer-provided keys (SSE-C) to the ObjectStore resource, closing #646.

S3-compatible providers such as Hetzner Object Storage do not offer bucket-managed encryption (SSE-S3 / SSE-KMS) and only support SSE-C. Without this, backups and WALs can only be stored unencrypted at rest on those providers.

Users can now reference a secret holding a base64-encoded 256-bit AES key via a new sseCustomerKey field:

apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
spec:
  configuration:
    destinationPath: "s3://BUCKET_NAME/path/to/folder"
    endpointURL: "https://fsn1.your-objectstorage.com"
    s3Credentials:
      accessKeyId: { name: aws-creds, key: ACCESS_KEY_ID }
      secretAccessKey: { name: aws-creds, key: ACCESS_SECRET_KEY }
      sseCustomerKey: { name: aws-sse-c, key: key }

What changed

The field is defined in the shared barman-cloud library and flows through the embedded BarmanObjectStoreConfiguration, so the plugin change is intentionally small:

File	Change
go.mod / go.sum	Bump barman-cloud to the version carrying sseCustomerKey
config/crd/bases/…_objectstores.yaml	Regenerated CRD (adds sseCustomerKey)
manifest.yaml	Regenerated consolidated installer
web/docs/object_stores.md	New "Server-Side Encryption with Customer Keys (SSE-C)" section

No controller logic changes are needed: the library injects --sse-customer-key file://… into every barman-cloud-* command (backup, wal-archive, wal-restore, restore, backup-list, backup-delete, check-wal-archive) and materializes the key from its secret, so all read/write paths are covered.

⚠️ Dependency — this is a draft

This PR depends on cloudnative-pg/barman-cloud#284, which adds the sseCustomerKey field and the --sse-customer-key wiring. Until that lands and is released, go.mod uses a temporary replace directive pointing at the change:

replace github.com/cloudnative-pg/barman-cloud => github.com/schaurian/barman-cloud <sse-c commit>

Once barman-cloud#284 is released, the replace should be dropped and the require bumped to the released version. Kept as a draft until then.

Runtime use additionally requires a sidecar image whose barman-cloud build ships the --sse-customer-key option (barman#973, merged to master).

Testing

• go build ./..., go vet ./... — clean
• CRD and manifest.yaml regenerated with controller-gen v0.21.0; both parse as valid YAML and diff to exactly the new field.

Closes #646

🤖 Generated with Claude Code