fix(deps): update module github.com/aws/amazon-s3-encryption-client-go/v3 to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/aws/amazon-s3-encryption-client-go/v3	v3.2.0 → v4.0.0

---

Release Notes

aws/amazon-s3-encryption-client-go (github.com/aws/amazon-s3-encryption-client-go/v3)

v4.0.0: -- 2025-12-16

Compare Source

Features

• Updates to the S3 Encryption Client

See migration guide from 3.x to 4.x: link

⚠ BREAKING CHANGES

• The S3 Encryption Client now uses key committing algorithm suites by default.
• Removed S3EncryptionClientV3 in favor of the upgraded S3EncryptionClientV4
• Updated expectations for custom implementations of the CryptographicMaterialsManager interface.
  • Custom implementations of the interface's GetEncryptionMaterials method MUST set the AlgorithmSuite field on the returned EncryptionMaterials.
    • The provided DefaultCryptographicMaterialsManager's GetEncryptionMaterials method and the provided NewEncryptionMaterials method set this field from the AlgorithmSuite provided in the req EncryptionMaterialsRequest.
    • If the custom implementation wraps the provided DefaultCryptographicMaterialsManager.GetEncryptionMaterials method or calls the provided NewEncryptionMaterials method, it's likely that no code updates are required. The provided logic has been updated with this change.
  • Custom implementations of the interface's DecryptMaterials method MUST set the KeyCommitment field on the returned CryptographicMaterials.
    • The provided DefaultCryptographicMaterialsManager's DecryptMaterials method and the provided DecryptMaterials method set this field from the KeyCommitment provided in the req DecryptMaterialsRequest.
    • If the custom implementation wraps the provided DefaultCryptographicMaterialsManager.DecryptMaterials method or calls the provided NewDecryptionMaterials method, it's likely that no code updates are required. The provided logic has been updated with this change.
• Updated expectations for custom implementations of the Keyring interface.
  • Custom implementations of the interface's OnDecrypt method MUST set the KeyCommitment field on the returned CryptographicMaterials.
    • The provided KmsKeyring's OnDecrypt method and the provided commonDecrypt method set this field from the KeyCommitment provided in the materials DecryptionMaterials.
    • If the custom implementation wraps the provided KmsKeyring.OnDecrypt method or calls the provided commonDecrypt method, it's likely that no code updates are required. The provided logic has been updated with this change.

Fixes

• Fixed an issue where nonces of invalid lengths could cause a panic during decryption.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "every weekend"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[nathanhruby]

Needs more help with migration

[nathanhruby]

hold