Add optional s3-acl input for canned ACLs on uploads

Lets the workflow set, e.g., public-read on the uploaded object so the
HTTPS URL is actually downloadable without further configuration. Empty
default means no ACL is sent — required for modern AWS buckets with
Object Ownership = "Bucket owner enforced" that reject any ACL.

Validates the value against the AWS canned-ACL list at config time so
typos fail before the upload runs. Wires the input through action.yml,
config, and the orchestrator; adds a unit test that the ACL is forwarded
to PutObjectInput when set and omitted when empty.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cmd/wails-release/main.go

@@ -169,7 +169,7 @@ func run(ctx context.Context) error {
 		}
 		key := upload.RenderKey(cfg.S3Key, resolvedVersion, artifactName)
 		s3URL, err = upload.Upload(ctx, client, upload.Opts{
-			Bucket: cfg.S3Bucket, Key: key, FilePath: zipPath,
+			Bucket: cfg.S3Bucket, Key: key, FilePath: zipPath, ACL: cfg.S3ACL,
 		})
 		if err != nil {
 			return err