@strapi/provider-upload-aws-s3 Incorrectly Sets public-read ACL Even with ACL: undefined
### Node Version

18.20.4

### NPM/Yarn/PNPM Version

10.8.2

### Strapi Version

5.9.0

### Operating System

Linux (Debian/Ubuntu)

### Database

MySQL

### Javascript or Typescript

Typescript

### Reproduction URL

_No response_

### Bug Description

The @strapi/provider-upload-aws-s3 provider is incorrectly setting the S3 object ACL to public-read even when ACL: undefined is explicitly specified in the config/plugins.js configuration. This occurs when the S3 bucket is configured with "ACLs disabled" and "Block all public access" enabled, which is the recommended AWS best practice.  The issue persists despite trying multiple provider versions, including versions that were supposed to fix this issue (as per issue #22280).

### Steps to Reproduce

Steps to Reproduce:

AWS Setup (Account Y - S3 Bucket):

Create an S3 bucket with "ACLs disabled (recommended)" and "Block all public access" enabled.
Create an IAM user with a policy allowing s3:PutObject, s3:GetObject, s3:DeleteObject, and s3:ListBucket for the bucket, and sts:AssumeRole for a role in Account X.
Create an inline policy to allow the user to use sts:AssumeRole.
AWS Setup (Account X - EC2 & IAM Role):

Create an IAM role that will be attached to EC2 instance.
Configure the role with a Trust Relationship allowing the IAM user from Account Y to assume this role (using an External ID for security).
Attach this IAM role to the EC2 instance.
Strapi Setup (Account X - EC2):

Install Strapi v(Your Strapi Version)
Install @strapi/provider-upload-aws-s3 (any of the tested versions).
Configure config/plugins.js as follows (replace placeholders with your actual values):

```typescript
module.exports = ({ env }) => ({
  upload: {
    config: {
      provider: '@strapi/provider-upload-aws-s3',
      providerOptions: {
        s3Options:{
          accessKeyId: env('AWS_ACCESS_KEY_ID'),
          secretAccessKey: env('AWS_SECRET_ACCESS_KEY'),
          region: env('AWS_REGION'),
          params: {
            Bucket: env('AWS_BUCKET'),
            // ACL: undefined,  // Explicitly disabling ACLs
          },
        },
        baseUrl: env("AWS_CLOUDFRONT_URL"), // Using CloudFront URL.
        assumeRole: {
          RoleArn: env('AWS_ROLE_ARN'),
          ExternalId: env('AWS_EXTERNAL_ID'),
        },
      },
    },
  },
});
``` 

Set the necessary environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, AWS_BUCKET, AWS_ROLE_ARN, AWS_EXTERNAL_ID, AWS_CLOUDFRONT_URL).
Create a Content Type: Create a Content-Type with a Media field.

Upload an Image: Upload an image through the Strapi admin panel.

### Expected Behavior

The image should be uploaded to the S3 bucket, and the ACL should not be set (or should be set to private if that's the default when no ACL is provided and the bucket has ACLs disabled). The image should be served via the configured CloudFront URL.

Actual Behavior:

The upload succeeds, but the provider incorrectly attempts to set the ACL to public-read.  This results in an AccessDenied error with the message: ...because public access control lists (ACLs) are blocked by the BlockPublicAcls block public access setting.  The image is not accessible.

Problematic Code Snippet (in @strapi/provider-upload-aws-s3/dist/index.js):

```javascript
config.params.ACL = fp.getOr(clientS3.ObjectCannedACL.public_read, ["params", "ACL"], config);
``` 

This line always defaults to public-read if config.params.ACL is "falsy" (including undefined), even when ACL: undefined is explicitly set in the configuration.

**Workaround (Temporary Fix):**

Manually modifying the index.js file (or using patch-package) to the following code fixes the issue:

```javascript
config.params.ACL = config.params.ACL === undefined ? undefined : (config.params.ACL || clientS3.ObjectCannedACL.private);
``` 
This change correctly respects undefined.

Additional Notes:

We have verified that the IAM policies, roles, trust relationships, and environment variables are configured correctly.
We have thoroughly tested with a clean Strapi installation and only the upload provider.
We have try with and without CloudFront.
We are using a cross-account setup with AssumeRole.
The reported issue, persist.
Request:

Please investigate this bug and provide a fix in the @strapi/provider-upload-aws-s3 package. The current behavior breaks the recommended AWS security best practices and prevents the use of the provider with buckets configured for optimal security (ACLs disabled).

### Logs

```shell

```

### Code Snippets

Problematic Code Snippet (in @strapi/provider-upload-aws-s3/dist/index.js):

```javascript
config.params.ACL = fp.getOr(clientS3.ObjectCannedACL.public_read, ["params", "ACL"], config);
``` 


### Media

_No response_

### Additional information

_No response_

### Confirmation Checklist

- [x] I have checked the existing [issues](https://github.com/strapi/strapi/issues) for duplicates.
- [x] I agree to follow this project's [Code of Conduct](https://github.com/strapi/strapi/blob/develop/CODE_OF_CONDUCT.md).