OSS backend cannot access new Alibaba Cloud buckets because it only supports Signature V1

Terraform Version

Terraform v1.16.3, and current main at db4eef44f5bbd39a115f939304279caee7cf9b12 is also affected.

Terraform Configuration Files

terraform {
  backend "oss" {
    bucket = "example-new-bucket"
    prefix = "daily"
    key    = "terraform.tfstate"
    region = "cn-qingdao"
  }
}

Credentials are supplied through the documented environment variables.

Expected Behavior

terraform init should authenticate to a newly-created Alibaba Cloud OSS bucket using Signature V4.

Alibaba Cloud stopped offering Signature V1 to new UIDs on March 1, 2025 and to newly-created buckets on September 1, 2025. Its migration guide requires OSS Go SDK v1 version 3.0.2 or later, oss.AuthVersion(oss.AuthV4), and an explicit region:

https://help.aliyun.com/zh/oss/developer-reference/guidelines-for-upgrading-v1-signatures-to-v4-signatures

Actual Behavior

Initialization fails before reading or writing state:

Failed to get existing workspaces: oss: service returned error: StatusCode=403,
ErrorCode=AccessDenied, ErrorMessage="V1 signature is forbidden.",
Ec=0002-00000080

The same credentials, bucket, and region work with aliyun oss ... --sign-version v4.

The current OSS backend depends on github.com/aliyun/aliyun-oss-go-sdk v2.2.7+incompatible, which is below Alibaba Cloud's recommended minimum version for V4 migration. That SDK version already exposes V4 client options, but the backend constructs the client without oss.AuthVersion(oss.AuthV4) or oss.Region(region), so it keeps the V1 default:

https://github.com/hashicorp/terraform/blob/main/internal/backend/remote-state/oss/backend.go

Steps to Reproduce

1. Use an Alibaba Cloud UID or OSS bucket for which Signature V1 is unavailable.
2. Configure the oss backend with the bucket and its region.
3. Run terraform init -reconfigure.

Additional Context and Proposed Direction

This makes the built-in OSS backend unusable for new Alibaba Cloud users and new buckets. The Alicloud provider's OSS client has already moved to Signature V4, but provider changes do not affect Terraform's built-in state backend.

I can prepare a focused PR that upgrades the OSS SDK, configures the client with its region, and adds test coverage proving requests use the V4 authorization scheme. I would appreciate maintainer guidance on compatibility policy: should V4 become the default, with an explicit V1 escape hatch for legacy endpoints, or should V4 initially be opt-in through a backend setting?