Adds `New(ctx, ...Option)` as the standard entry point for creating an
`objectstore.Client` from the runtime infrastructure config, mirroring the
pattern used in the `postgres` package. It loads
`infrastructure.DefaultConfig()` when no `WithInfraConfig` option is provided,
then delegates to `configFromProto` before calling the existing
`NewWithConfig`.

`configFromProto` reads the `ObjectStore` oneof from the proto config and
dispatches to `gcsConfigFromProto` or `s3ConfigFromProto`. It wraps the
infrastructure secret provider in a `PrefixProvider("objectstore/")` so that
all downstream secret lookups are automatically namespaced. Metadata fields
(`name`, `namespace`, `subsystem`) fall back to package-level defaults via
`cmp.Or`.

`s3ConfigFromProto` resolves `accessKeyId`, `secretAccessKey`, and
`sessionToken` through a `ProjectionProvider` built from the
`S3SecretProjection` in the proto. The helper `unsetToEmpty` absorbs
`ErrNotFound` and `ErrProjectionMissing` (treating absent credentials as empty
strings to support IRSA/WIF fallback), while propagating any other error.
`gcsConfigFromProto` is a stub pending GCS credentials support.

Adds `Option` / `clientOptions` / `WithInfraConfig` to `client.go` to allow
tests and callers to inject an `infrastructure.Config` directly.

Covers the new code with `TestConfigFromProto` (nil/missing config, unknown
backend, GCS defaults, S3 full and partial credential resolution) and
`TestS3ConfigFromProto` (all fields, optional fields, `ErrNotFound`,
`ErrProjectionMissing`, per-field unexpected errors, and multi-error joining).

Issues:
- gitlab-com/gl-infra/platform/runway/team#875
- gitlab-com/gl-infra/platform/runway/team#876

Sets `Backend` to `BackendGCS` or `BackendS3` in `gcsConfigFromProto` and
`s3ConfigFromProto` respectively. Previously the field was left at its zero
value, causing `NewWithConfig` to return an error.  Updates all affected golden
structs in `binding_test.go` and `client_test.go`.

Adds `TestNew` in `client_test.go` (external test package) covering three
cases: a valid S3 config that returns a usable `Client` with the correct
`Backend`, `Name`, and non-nil `Bucket`; a config with no `ObjectStore` block
returning `ErrNotConfigured`; and an `ObjectStore` with no backend set
returning `ErrUnknownObjectStore`. The happy-path case drives a real `New` call
against an in-process S3 server via `s3test.New`, exercising the full
`configFromProto` → `s3ConfigFromProto` → `NewWithConfig` path including the
`PrefixProvider` and `ProjectionProvider` secret chain.

Stops defaulting the name, namespace, and subsystem fields in
`configFromProto`, leaving them as zero values when not explicitly set so
`NewWithConfig` fills them in. Previously the defaults were applied via
`cmp.Or` here as well, duplicating the default identity values across
`binding.go` and `client.go`.

Moves the `defaultName`, `defaultNamespace`, and `defaultSubsystem` consts to
`client.go` and uses them in place of the inline string literals in
`NewWithConfig`, so the defaults now live in a single place.

Adds an `ErrMissingSecrets` sentinel and guards `configFromProto` against a nil
`infraCfg.Secrets`, returning it before wrapping the provider. Without the
check, a missing secret provider surfaced later as an opaque failure rather
than a clear, matchable error.

Corrects the `New` doc comment: `secret.ErrProjectionMissing` is returned when
there is a user configuration issue – `ErrMissingSecrets` is only returned when
there is an internal logic issue.

feat(objectstore): Add proto-driven `New` constructor and `configFromProto` binding.

See merge request !556

Merged-by: Luke Hollinda <lhollinda@gitlab.com>
Approved-by: Luke Hollinda <lhollinda@gitlab.com>
Reviewed-by: Florian Forster <fforster@gitlab.com>
Reviewed-by: GitLab Duo <gitlab-duo@gitlab.com>
Co-authored-by: Florian Forster <fforster@gitlab.com>