**Use case**
With S3, you have to send the header `x-amz-server-side-encryption-customer-key` and `x-amz-server-side-encryption-customer-key-md5` if the resource is server side encrypted.

https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeysSSEUsingRESTAPI.html
https://docs.aws.amazon.com/AmazonS3/latest/dev/ServerSideEncryptionCustomerKeys.html

**Describe the solution you'd like**
Ability to set this in the query.
if (!config.getBool(config_prefix + ".skip_access_check", false))
        {
            checkWriteAccess(*s3disk);
            checkReadAccess(name, *s3disk);
            checkRemoveAccess(*s3disk);
        }
        s3disk->restore();
        s3disk->startup();
        bool cache_enabled = config.getBool(config_prefix + ".cache_enabled", true);
        if (cache_enabled)
        {
            String cache_path = config.getString(config_prefix + ".cache_path", context.getPath() + "disks/" + name + "/cache/");
            if (metadata_path == cache_path)
                throw Exception("Metadata and cache path should be different: " + metadata_path, ErrorCodes::BAD_ARGUMENTS);
            auto cache_disk = std::make_shared<DiskLocal>("s3-cache", cache_path, 0);
            auto cache_file_predicate = [] (const String & path)
            {
                return path.ends_with("idx") 
                       || path.ends_with("mrk") || path.ends_with("mrk2") || path.ends_with("mrk3") 
                       || path.ends_with("txt") || path.ends_with("dat");
            };
            return std::make_shared<DiskCacheWrapper>(s3disk, cache_disk, cache_file_predicate);
        }
        return s3disk;
    };
    factory.registerDiskType("s3", creator);
}
}