s3guard set-capacity command to fail on read/write of 0

the command hadoop s3guard set-capacity -read 0 s3a://bucket will get all the way to the AWS SDK before it's rejected; if you pass in a value of -1 we fail fast.

The CLI check should really be failing on <= 0, not < 0.

You still get a stack trace, so it's not that important.