fix(publish): set x-amz-content-sha256: UNSIGNED-PAYLOAD before SigV4 signing

[mmaietta]

Fixes #9862

• Root cause: startS3PutObject in s3UploadHelper.ts called aws4.sign() without a body and without setting x-amz-content-sha256. The aws4 library defaulted the payload hash to SHA256("") = e3b0c442…, but the actual file bytes are streamed to S3 afterward. S3 computes the real file hash on receipt and compares it against the signed hash — they never match for any non-empty upload, resulting in XAmzContentSHA256Mismatch (HTTP 400).

• Fix: Set "x-amz-content-sha256": "UNSIGNED-PAYLOAD" in the request headers before calling aws4.sign(). With this header present, aws4 incorporates the literal string "UNSIGNED-PAYLOAD" into the canonical request's payload-hash field and includes x-amz-content-sha256 in SignedHeaders. S3 recognises UNSIGNED-PAYLOAD as the standard streaming-upload declaration and skips payload-hash verification while still validating the request signature, date, and all other signed headers. This is the AWS-documented approach for streaming/piped uploads.
  https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html

[changeset-bot]

🦋 Changeset detected

Latest commit: 1fe2f8c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 9 packages

Name	Type
electron-publish	Patch
app-builder-lib	Patch
dmg-builder	Patch
electron-builder-squirrel-windows	Patch
electron-builder	Patch
electron-forge-maker-appimage	Patch
electron-forge-maker-nsis-web	Patch
electron-forge-maker-nsis	Patch
electron-forge-maker-snap	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR