fix: respect snapshot protection flag in S3 Ceph backend

[merkys7]

Summary

This PR fixes a bug where protected backups were being deleted by the garbage collector due to incorrect tag handling.

---

Problem

• The .Protected field in Snapshot was previously set using object.UserTags["protected"].
• ListObjects() with metadata does not return actual S3 object tags on many backends (e.g. Ceph) - see related issue - garbagecollector fails: object has no csum metadata flag set #64
• As a result, Protected remained unset on Ceph S3, and protected backups were not respected or preserved.

---

Fix

• Introduced a call to Snapshot.ReadTags() immediately after creating each snapshot entry in ListSnapshots().
• If the tag protected=true is present on index.json.blob, .Protected is now set correctly.

---

Impact

• Garbage collector now correctly preserves snapshots marked as protected on Ceph backend.
• Ensures compatibility across AWS S3, MinIO, and Ceph-based backends.
• Improves snapshot lifecycle safety and reliability.

To reproduce

Activate pmoxs3backuproxy on Ceph S3 backend and try to change backup protection status.
Before the fix - chaning protection status does not reflect

After the patch - chaing protection status does reflect

2025/06/19 13:06:17.036324 [  INFO ] 1 snapshots in bucket
2025/06/19 13:06:17.036332 [  INFO ] Backup %!s(func() string=0x773600),32634/1745925605 is older than 7 but marked as protected, skip removal.
2025/06/19 13:06:17.036341 [  INFO ] Fetching object hashes

[abbbi]

w/o having done any testing, does the commit actually handle the logging line correctly?

2025/06/19 13:06:17.036332 [ INFO ] Backup %!s(func() string=0x773600),32634/1745925605 is older than 7 but marked as protected, skip removal.