`s3:versionid` policy condition not working on DeleteObject calls

Relevant policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:ReplicateObject",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetBucketVersioning"
      ],
      "Resource": [
        "arn:aws:s3:::test/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::test",
        "arn:aws:s3:::test/*"
      ],
      "Condition": {
        "Null": {
          "s3:versionid": "true"
        }
      }
    }
  ]
}

Expected Behavior

DeleteMultipleObjects() calls should be successful when VersionID is not set in the delete request

Current Behavior

DeleteMultipleObjects() calls are always failing with AccessDenied (although returning HTTP status code 200)

Possible Solution

Steps to Reproduce (for bugs)

1. bucket, user, and apply this policy
2. Upload a file in this bucket
3. Run mcli rm <remote_file>
4. Notice the call is failing, although --versions was not set (and the client request did not include VersionId)

Context

I would like to protect myself against compromised clients by having the ability to always rollback my bucket to an older state. To do that, I must prevent my client from deleting old object versions An alternative solution would be to block the ListObjectVersions() call so the client doesn't have access to version IDs, but maybe these IDs are available by other ways.

Regression

I don't know

Your Environment

minio version RELEASE.2025-09-07T16-13-09Z (commit-id=07c3a429bfed433e49018cb0f78a52145d4bedeb) mcli version RELEASE.2025-08-13T08-35-41Z (commit-id=7394ce0dd2a80935aded936b09fa12cbb3cb8096)