[MBrassey]

Static aws_auth credentials take an access key and a secret only, so temporary (STS) credentials cannot be used with them: the session token has nowhere to go, and AWS rejects a request signed with a temporary key and no token.

This adds an optional session_token source beside access_key_id and secret_access_key. When it is set, the token is carried into the credentials and the request is signed with X-Amz-Security-Token (so it is also in SignedHeaders), as already happens for credentials_provider: workload_identity. It is refused unless both static fields are set, and nothing changes for a config without it.

Tests:

• credentials carry the token when it is configured, and none when it is not;
• a request signed with static temporary credentials carries X-Amz-Security-Token and signs it;
• session_token without the static fields is refused.

iron-proxy.example.yaml documents the new field.