Function bucketInspect

Inspect a bucket and return an aggregated BucketInspectorReport.

Each section in the report has a kind discriminator:

• "value" — the API succeeded.
• "denied" — IAM policy blocked this section; iamAction names the required permission (e.g. "s3:GetBucketVersioning").
• "unsupported" — the provider does not implement this API.
• "deferred" — intentionally absent in v1 (currently only bucketPolicy).

AccessDenied outcomes are automatically cached on the Rust side so the UI can render disabled reasons on subsequent renders without re-fetching.