Address review: make SSE-S3 metadata serialization failures fatal errors

- In executeEncryptCopy: return error instead of just logging if
  SerializeSSES3Metadata fails
- In createChunkFromData: return error if chunk SSE-S3 metadata
  serialization fails

This ensures objects/chunks are never created without proper encryption
metadata, preventing unreadable/corrupted data.

weed/s3api/s3api_object_handlers_copy_unified.go

@@ -148,13 +148,13 @@ func (s3a *S3ApiServer) executeEncryptCopy(entry *filer_pb.Entry, r *http.Reques
 				if len(encSpec.DestinationIV) > 0 {
 					sseKey.IV = encSpec.DestinationIV
 				}
-				if keyData, serErr := SerializeSSES3Metadata(sseKey); serErr == nil {
+			keyData, serErr := SerializeSSES3Metadata(sseKey)
+			if serErr != nil {
+				return nil, nil, fmt.Errorf("failed to serialize SSE-S3 metadata: %w", serErr)
+			}
 			dstMetadata[s3_constants.SeaweedFSSSES3Key] = keyData
 			dstMetadata[s3_constants.AmzServerSideEncryption] = []byte("AES256")
 			glog.V(3).Infof("Generated SSE-S3 metadata for streaming encrypt copy: %s", dstPath)
-				} else {
-					glog.Errorf("Failed to serialize SSE-S3 metadata: %v", serErr)
-				}
 			}
 		}
 		return chunks, dstMetadata, nil

weed/s3api/s3api_streaming_copy.go

@@ -524,9 +524,11 @@ func (scm *StreamingCopyManager) createChunkFromData(data []byte, offset int64,
 					Algorithm: sseKey.Algorithm,
 					IV:        chunkIV,
 				}
-					if chunkMetadata, serErr := SerializeSSES3Metadata(chunkSSEKey); serErr == nil {
-						chunk.SseMetadata = chunkMetadata
+				chunkMetadata, serErr := SerializeSSES3Metadata(chunkSSEKey)
+				if serErr != nil {
+					return nil, fmt.Errorf("failed to serialize chunk SSE-S3 metadata: %w", serErr)
 				}
+				chunk.SseMetadata = chunkMetadata
 				}
 			}
 		}