Replace request TTL for GET/HEAD/RANGE

[cthulhu-rider]

Is your feature request related to a problem? Please describe.

currently, SN handles https://github.com/nspcc-dev/neofs-api/blob/becf47f13cbb10ae73cd6cd7bb979db07eb47654/session/types.proto#L224 field to determine whether object request should be handled locally-only or it can be forwarded to other SN. If ttl <= 1, local storage is accessed only. Otherwise, remote SN can be called as well

TTL also prevents query looping

local storage is always checked first

neofs-node/pkg/services/object/get/get.go

Lines 333 to 340 in 2507f0e

	func (exec *execCtx) execute() {
	exec.log.Debug("serving request...")
	// perform local operation
	exec.executeLocal()
	exec.analyzeStatus(true)
	}

to make this behave properly, recursive meta header was originally introduced https://github.com/nspcc-dev/neofs-api/blob/aa5f16c4606cb453a92b55db491de026b120ff26/session/types.proto#L240

this approach complicates the request format (i.e. its formation/processing), and also goes beyond the client authentication on which the behavior should be based

Describe the solution you'd like

get rid of recursive request structure. Instead, authenticate clien (this is done for authorization in any case) and determine what server is

client can be a user, that is anyone outside the current network map

SN can be in the current network map but outside the current container (proxy). In this case, just forward request to first responsive container SN. This simulates redirect mechanism

thus, only server=container performs data operations incl. split-chain joining. Also, if client=container, request is handled local-only

Additional context

#3413

[roman-khimov]

Rather we need to replace the request when handling in-container things. Non-container nodes can proxy with no changes (original request, one signature, ttl=2), then container nodes create new requests signed by them as appropriate (one signature, ttl=1 directed to replica or EC part holders). This makes ttl kinda binary (same way it is now, only 2/1 can be used) and this leaves the original request handling (wrt security checks) to the first container node, others receive easy to check in-container requests and not bother with the original one. Security-wise this changes nothing since nodes already can do this and nodes already have permissions to GET/HEAD/RANGE anything they'd like to.