lambda: negative duration for presigned URL default to 1H (#17489)

fixes a bug where users created with Expiration as
timeSentinel is not rejected while generating the
presigned URL for lambda processing.

cmd/object-lambda-handlers.go

@@ -47,7 +47,7 @@ func getLambdaEventData(bucket, object string, cred auth.Credentials, r *http.Re
 	}
 
 	duration := time.Until(cred.Expiration)
-	if cred.Expiration.IsZero() || duration > time.Hour {
+	if duration > time.Hour || duration < time.Hour {
 		// Always limit to 1 hour.
 		duration = time.Hour
 	}