Description of problem:

the PutObjectRetention operation allows changes to the Retention Mode that aren't permitted by AWS S3

notably, rgw allows the retention mode to be changed from COMPLIANCE to GOVERNANCE, which is an unintended workaround that allows the deletion of objects locked in COMPLIANCE mode

from https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html
> In compliance mode, a protected object version can't be overwritten or deleted by any user, including the root user in your AWS account. When an object is locked in compliance mode, its retention mode can't be changed, and its retention period can't be shortened.

rgw also allows the GOVERNANCE mode to be changed to COMPLIANCE without checking for governance bypass permissions. from that same document:
> To override or remove governance-mode retention settings, a user must have the s3:BypassGovernanceRetention permission and must explicitly include x-amz-bypass-governance-retention:true as a request header with any request that requires overriding governance mode. 


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. create a bucket with object lock enabled
2. upload an object with ObjectLockMode='GOVERNANCE' or 'COMPLIANCE'
3. use the PutObjectRetention api to change the retention mode

Actual results:

PutObjectRetention returns success and changes the retention mode (as long as the new retention date is not earlier than the existing date)

Expected results:

PutObjectRetention returns 403 AccessDenied on invalid changes to retention mode

Additional info: