fix(policy)!: separate password self service and update upstream SDK

[Vonng]

Self-service password changes currently share the reported admin:CreateUser capability with privileged user administration. Adapt minio/pkg minio#262 so admin:ChangeMyPassword is implicit unless denied, while CreateUser requires an explicit grant. Remove the built-in readonly CreateUser deny and adopt minio#233's consolereadonly policy with the same split.

Pin minio-go to upstream 78bfa91607c2 and record the upstream review in UPSTREAM.md. SDK #2301 is included; #2274 remains open upstream and is deferred. Existing SILO policy correctness fixes and the Go 1.26 floor are retained.

Breaking authorization compatibility: the Go signatures are retained, but Policy.IsAllowedActions returns different capabilities. With the matching Server, a saved CreateUser deny no longer locks the caller's password, and a ChangeMyPassword deny now locks it. To preserve the old combined restriction, deny both actions in the same statement before upgrading. The new built-in readonly also stops overriding a separate CreateUser grant; saved overrides retain their existing denies. Policies are not rewritten automatically. This permission-design change is independent of updating the SDK and must be disclosed as breaking in the release that includes it.

This must ship with Server #175, Console #51 and mcli #41. See the migration guide for the before/after matrix, saved read-only policies, mixed-version rollout and rollback. An old Server cannot enforce a password-only deny for this endpoint. No release tag is created here.

Validation:

• make test (lint and all package tests with race detection)
• GOWORK=off GOTOOLCHAIN=go1.26.0 go test ./...
• SDK go test -short -race ./... at the pinned upstream version
• Legacy-policy read/write/merge tests, explicit and wildcard denies, and composed read-only grants
• Coordinated Server IAM, Console session/browser, and mcli tests
• Documentation follow-up checked against the pre-split and current implementations; git diff --check passes, with no runtime or dependency changes

No authorization hot-path algorithm changes are introduced. IsAllowedActions retains its existing iteration structure.