fix(security): clear open high-severity CodeQL alerts (SEC-X1) - #1534

do not define dynamic errors, use wrapped static errors instead: "fmt.Errorf(\"bucket: name is required\")" (err113)

do not define dynamic errors, use wrapped static errors instead: "fmt.Errorf(\"fixtures declare buckets but Target.Storage is nil\")" (err113)

use "Opc-Request-Id" instead of "opc-request-id" (canonicalheader)

use "Opc-Request-Id" instead of "opc-request-id" (canonicalheader)

use "Opc-Request-Id" instead of "opc-request-id" (canonicalheader)

use "Opc-Work-Request-Id" instead of "opc-work-request-id" (canonicalheader)

use "Opc-Next-Page" instead of "opc-next-page" (canonicalheader)

use "X-Ms-Time-Next-Visible" instead of "x-ms-time-next-visible" (canonicalheader)

use "X-Ms-Popreceipt" instead of "x-ms-popreceipt" (canonicalheader)

use "X-Ms-Approximate-Messages-Count" instead of "x-ms-approximate-messages-count" (canonicalheader)

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-go@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

golangci-lint reported findings (advisory)