s4-auth: match the new s3 gensec client and always negotiate SIGN with SEAL