Allow to use S3 StrictAuthenticatedEncryption with a local keystore

With NXP-32760, we upgraded the AWS SDK encryption APIs from v1 to v2 and we had to set CryptoMode.AuthenticatedEncryption when using client-side encryption with a local keystore to decrypt objects encrypted in v1.

This produces WARNS like:

[AmazonS3EncryptionClientV2] The S3 Encryption Client is configured to read encrypted data with legacy encryption modes through the CryptoMode setting. If you don't have objects encrypted with these legacy modes, you should disable support for them to enhance security. See https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html

• see https://jira.nuxeo.com/browse/NXP-32760?focusedCommentId=866676&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-866676
• see also https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/s3-encryption-migration.html#s3-cse-update-code

However, if one wants to start a fresh production environment with a higher level of security, we should allow the use of the default CryptoMode.StrictAuthenticatedEncryption

A nuxeo.s3storage.crypt.keystore.legacymode configuration property default to true for lts-2023, and false for lts-2025 can be offered.

Need for 2025 upgrade notes