Add modular AWS credential resolution

[mtdowling]

Add modular credential chain with pluggable provider discovery

Adds a modular AWS credential provider chain that separates credential detection from resolution, enabling independent artifact composition.

New modules:

• aws-config: SEP-conformant INI parser, AwsProfileFile, AwsProfile, AwsConfigCredentialSource sealed types. Standalone module with no chain dependency.
• aws-credential-chain: CredentialChain, ChainIdentityProvider SPI, ChainSetup, StandardProvider enum with expanded profile-source slots, OrderingConstraint (Standard/Before/After), SharedConfigProvider, StaticKeysHandler, SessionKeysHandler, CredentialProcessHandler.
• aws-credentials-imds: IMDSv2 credential provider with static stability, extended/legacy API fallback, config-based disable.

Changes to existing modules:

• auth-api: Add CachingIdentityResolver with async background refresh, static stability, injectable Clock/ScheduledExecutorService. Add invalidate() default method to IdentityResolver.
• aws-client-core: Add AwsCredentialChainPlugin, auth-failure interceptor, EnvironmentCredentialProvider and
  SystemPropertiesCredentialProvider (both terminal — stop chain assembly when credentials are present).
• settings.gradle.kts: Include new modules.

Architecture:

• One interface (ChainIdentityProvider), one SPI, void create() method.
• Providers are sorted by ordering() then called in order with a shared mutable ChainSetup. They call setup.addResolver() to register, or setup.addTerminalResolver() to register and stop assembly.
• StandardProvider enum encodes the full chain precedence including per-profile-source slots, matching the Credentials Provider Chain Search Precedence SEP exactly.
• SharedConfigProvider parses config files and sets profile on setup; downstream profile providers read from setup.profile().
• Terminal resolvers short-circuit assembly (env vars set → config never parsed, IMDS never created).
• Actionable errors name the missing module when a source is detected but no provider claims its slot.
• CachingIdentityResolver provides background refresh; invalidate() propagates through the chain to clear caches on auth failures.

TODO: STS, SSO, ECS, Login providers.

---

Example usage:

// build.gradle.kts
dependencies {
    implementation("software.amazon.smithy.java:aws-client-core:1.1.0")
    implementation("software.amazon.smithy.java:aws-credential-chain:1.1.0")
    implementation("software.amazon.smithy.java:aws-credentials-imds:1.1.0")
}

var client = CoffeeShopClient.builder()
        .addPlugin(new AwsCredentialChainPlugin())
        .build();

Credentials resolve automatically in order:

1. JVM system properties (aws.accessKeyId) — terminal
2. Environment variables (AWS_ACCESS_KEY_ID) — terminal
3. Config file static/session keys — terminal
4. Config file credential_process
5. EC2 IMDS (if aws-credentials-imds is added)

On Lambda, only aws-client-core is needed (env vars are terminal, nothing else is constructed):

dependencies {
    implementation("software.amazon.smithy.java:aws-client-core:1.1.0")
    implementation("software.amazon.smithy.java:aws-credential-chain:1.1.0")
}