vos: add per-object aggregation API (vos_aggregate_obj)

[Copilot]

Reimplement VOS aggregation so that the production driver iterates objects from outside VOS and dispatches per-OID aggregation through vos_aggregate_obj(). This unblocks a future change that places each per-OID call into its own ULT.

• Add per-object API vos_aggregate_obj() (already merged earlier on this branch)
• Extend vos_aggregate_obj() with unsigned int *out_flags so callers can detect uncommitted-DTX (VOS_AGG_OUT_IN_PROGRESS) and skip advancing cd_hae
• Add public API vos_aggregate_advance_hae() so external drivers can monotonically advance the container HAE after a clean per-OID fan-out
• Reimplement cont_vos_aggregate_cb() in container/srv_target.c:
  • Query container info (ci_hae, ci_agg_write)
  • Container-level fast path on ci_agg_write <= filter_epoch
  • vos_iterate(VOS_ITER_OBJ, recursive=false) with a filter callback that reuses vos_iter_desc_t::id_agg_write / id_parent_punch for per-OID skip
  • Dispatch vos_aggregate_obj() per OID; suppress -DER_CSUM per-OID (matches legacy semantics)
  • vos_aggregate_advance_hae() only when no VOS_AGG_OUT_IN_PROGRESS was reported
• Update existing call sites/tests of vos_aggregate_obj() to match new signature; smoke test now also exercises vos_aggregate_advance_hae()
• Validate via parallel_validation (Code Review + CodeQL ✅)

Existing callers of legacy vos_aggregate() (RDB, VOS unit tests, vos_perf) are untouched and continue to use the convenience wrapper.

[daosbuild3]

Test stage Functional on EL 9 completed with status FAILURE. https://jenkins-3.daos.hpc.amslabs.hpecorp.net//job/daos-stack/job/daos/view/change-requests/job/PR-18206/2/execution/node/1095/log