feat(admin): add typed IAM policy detach

[cxymds]

Summary

• add rc admin policy detach with exactly one user/group selector and deterministic multi-policy input
• use typed, bounded admin request/response handling and fail closed when the detach capability is absent
• report detached, still-attached, and unchanged policies with stable human and output-v3 results
• preserve idempotent retry behavior and distinguish auth, not-found, unsupported, validation, conflict, and network failures

BREAKING contract update

The protected command reference is extended with the new detach subcommand and its selector rules. Existing commands and output schemas remain backward compatible.

Validation

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• git diff --check

Closes rustfs/backlog#1492
Refs rustfs/backlog#1380