Fix the audit of who can read a bucket

An assistant's Terraform for an avatar bucket set all four public-access-block flags to false and allowed s3:GetObject to *, which means anyone on the internet. Those four flags are S3's guards against public access. The team now audits every bucket config for who can read its objects.

An assistant wrote bucket_read_principals(config). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• config: the bucket's settings, one string per line, each meant to be key=value. The list can be empty.
• Return who can read objects, as a list of strings with no repeats, sorted in ascending order.

Rules the tests check:

• Split each line at its first =. Ignore a line with no =, and ignore unknown keys.
• The flags are block_public_acls, block_public_policy, ignore_public_acls and restrict_public_buckets. Each starts as true. A line sets its flag to true only when the value is exactly true; any other value, such as false or TRUE, sets it to false. A later line overrides an earlier one.
• statement=<effect>|<principal>|<action> is a policy statement. Ignore it unless the value splits on | into exactly 3 parts, the action is s3:GetObject or s3:*, and the principal is not empty. The effect is Allow or Deny; ignore any other effect.
• acl=<grantee> grants read through the bucket's access list. Ignore an empty grantee.
• If any Deny principal is *, return an empty list.
• The policy door: an Allow for * counts only when both block_public_policy and restrict_public_buckets are false. Either one being true drops it. Every other Allow principal counts.
• The access-list door: a grant to AllUsers or AuthenticatedUsers counts only when both block_public_acls and ignore_public_acls are false. Every other grantee counts.
• Remove any principal that has a Deny, wherever its read came from.