Since botocore ~1.36 (early 2025) the default
RequestChecksumCalculation is when_supported, so barman-cloud's boto3
attaches a flexible checksum to every PutObject. AWS S3 accepts it,
but non-AWS S3-compatible backends - Ceph RADOS Gateway, the
platform's own SeaweedFS system bucket, some MinIO / Cloudflare R2
builds - reject it with "InvalidArgument: x-amz-content-sha256 must
be UNSIGNED-PAYLOAD, ...", which fails every backup and WAL-archive
upload.

Set AWS_REQUEST_CHECKSUM_CALCULATION=when_required through the CNPG
Cluster's spec.env, which reaches the instance pods and therefore the
barman-cloud subprocess the instance manager execs.

This is a release-1.5-native equivalent of #3417 rather than a
cherry-pick of it. That change sets
spec.instanceSidecarConfiguration.env on barmancloud.cnpg.io
ObjectStore objects, and release-1.5 has no barman-cloud plugin:
there is no ObjectStore CRD on the branch and the rendered Cluster
carries no spec.plugins, so those objects would template cleanly and
then fail to apply, referenced by nothing. release-1.5 still uses
CNPG's native in-tree spec.backup.barmanObjectStore, which shells out
to the same barman-cloud client, so the bug is reachable here - the
plugin is the packaging difference, not the cause.

One spec.env covers all three paths on this branch at once: the
chart-rendered legacy barmanObjectStore, the same field SSA-patched
by the CNPG backup driver in the useSystemBucket flow, and
externalClusters recovery. No Go change is needed - the driver's
patch type carries only spec.backup and spec.bootstrap, so it cannot
express or remove the Helm-owned spec.env.

keycloak is out of scope on this branch. Its chart renders a CNPG
Cluster but configures no backup at all - no backup key in values,
no backup template - so it has no barman-cloud path to fix, and the
upstream hunk for it references values that do not exist here.

Verified against CNPG 1.27.3: spec.env is accepted by the webhook
and stored unmodified, appears in the instance manager's own
environment, and botocore inside the instance image then resolves
request_checksum_calculation as when_required instead of its
when_supported default. Adding the field to an already-running
Cluster converges back to healthy after CNPG recreates the instance
pod, which is the in-place upgrade path for existing releases with
backups enabled.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>