[MBrassey]

Problem

The static aws_auth path reads only access_key_id and secret_access_key. Temporary credentials from STS (AssumeRole, AssumeRoleWithWebIdentity) need their session token too. Without it the request is signed without X-Amz-Security-Token, and AWS answers 403 to every call. So a control plane that mints short-lived STS credentials and pushes them into the proxy has no way to use them, and has to fall back to long-lived IAM user keys.

Change

• session_token is a new optional field next to the two keys. It takes any registered secret source (env, aws_sm, 1password, and so on).
• When it is set, staticSourceProvider.Retrieve returns it in aws.Credentials.SessionToken. The existing signing path then adds X-Amz-Security-Token, as it already does for workload_identity.
• It belongs to the static path. Combined with credentials_provider it is rejected ("not both"). Set without the keys, it reports the missing access_key_id.
• Configs without session_token behave exactly as before.
• iron-proxy.example.yaml documents the field.

Tests

go test ./internal/transform/awsauth/ covers:

• A static config with a session token puts the token in X-Amz-Security-Token, and the signature's SignedHeaders include it.
• Table-driven config validation: a token without keys, a token together with credentials_provider, and a token source that cannot be built.
• Table-driven Retrieve: no token, a token, and a token source that returns an error.

[MBrassey]

Closing in favour of #285, which carries the same optional session_token for static credentials in a smaller change. Keeping one PR open for review.