Upgrade to drive v0.25.3.

**Breaking change:** following upstream, the S3 object storage changed from MinIO (`bitnamilegacy/minio`, unmaintained) to RustFS (`rustfs/rustfs`). RustFS cannot read the MinIO data, so existing media files must be copied once:

```
abra app config <app-domain>   # add:
                               #   RUSTFS_DOMAIN="${MINIO_DOMAIN}"
                               #   SECRET_RUSTFS_RP_VERSION=v1
                               #   SECRET_RUSTFS_RU_VERSION=v1
                               #   COMPOSE_FILE="compose.yml:compose.minio-migration.yml"
abra app secret generate <app-domain> rustfs_ru v1
abra app secret generate <app-domain> rustfs_rp v1
abra app upgrade <app-domain>
abra app cmd <app-domain> backend migrate_from_minio
abra app config <app-domain>   # remove the COMPOSE_FILE line
abra app deploy <app-domain> --force
```

See README "Migrating from MinIO" for details. RustFS uses the new `rustfs_ru`/`rustfs_rp` secrets and `RUSTFS_DOMAIN`. The old `minio_ru`/`minio_rp` secrets and `MINIO_DOMAIN` are only needed during the migration.

**Breaking change:** the Collabora image is distroless and cannot read Docker secrets, so the `collabora_p` secret is no longer used. The admin panel is unusable until you set `COLLABORA_ADMIN_PASSWORD` with `abra app config <app-domain>`. The password is passed as a plain environment variable, visible in `docker service inspect`. Remove `SECRET_COLLABORA_P_VERSION` from your config, and optionally the secret with `abra app secret remove <app-domain> collabora_p`. See README "Configure the Collabora Admin Panel".

Other changes:
- The S3 bucket is now created by the backend on startup (`abra app cmd <app-domain> backend s3_initialize`), the `minio_initialize` command is gone.
- Maintenance commands `clean_pending_items` (daily 0:30) and `purge_deleted_items` (daily 0:45) are now scheduled by celery beat. Configure with `CLEAN_PENDING_ITEMS_SCHEDULE` / `PURGE_DELETED_ITEMS_SCHEDULE`. Note that this permanently purges items deleted from the trash after the upstream grace periods (30 + 7 days).
- New `SDK_ENABLED` setting (default `false`) for the SDK picker used by other La Suite apps.
- The celery workers now get the S3 access key secret too.