s3: Factor out calculate_open_access_flags