Allow pinning to WebIdentityTokenCredentialsProvider in native S3 client

[nineinchnick]

Description

Allow users to only use the StsWebIdentityTokenFileCredentialsProvider instead of the default credentials provider chain.

This complements the same flag in the legacy library, see #22162. This at least makes the workaround for #15267 easier, I'm not sure if it will allow closing that issue. I haven't updated the docs yet, I'll wait for some initial feedback first.

I used StsWebIdentityTokenFileCredentialsProvider instead of WebIdentityTokenFileCredentialsProvider based on the Javadoc recommendations around periodic updates, and because we can configure a custom STS client.

Additional context and related issues

Release notes

( ) This is not user-visible or is docs only, and no release notes are required.
(x) Release notes are required. Please propose a release note for me.
( ) Release notes are required, with the following suggested text:

# Section
* Fix some things. ({issue}`issuenumber`)

[mehulbatra-d11]

we are eagerly waiting on this, hope this will be merged and released soon!

[electrum]

I don't love this config name, but I can't think of anything better. Thanks for fixing this.

[nineinchnick]

@electrum me too. Thanks for reviewing it, can you merge this?

[nineinchnick]

I tested this by deploying Trino on EKS, using https://github.com/binayakd/trino-on-eks
and these chart values:

image:
  repository: nineinchnick/test
  tag: 449-SNAPSHOT-amd64
server:
  workers: 1
additionalCatalogs:
  s3_hive: |-
    connector.name=hive
    hive.metastore.uri=thrift://metastore:9083
    fs.native-s3.enabled=true
    s3.region=eu-central-1
    s3.use-web-identity-token-credentials-provider=true
coordinator:
  additionalJVMConfig:
  - -XX:+UnlockDiagnosticVMOptions
  - -XX:G1NumCollectionsKeepPinned=10000000
worker:
  additionalJVMConfig:
  - -XX:+UnlockDiagnosticVMOptions
  - -XX:G1NumCollectionsKeepPinned=10000000
additionalLogProperties:
- software.amazon.awssdk=DEBUG

I checked the logs and I see it making the request:

2024-06-04T09:53:59.066Z        DEBUG   SplitRunner-20240604_095351_00000_crysi.0.0.0-1-97      software.amazon.awssdk.utils.cache.CachedSupplier       (StsAssumeRoleWithWebIdentityCredentialsProvider()) Cached value is stale and will be refreshe
d.
2024-06-04T09:53:59.066Z        DEBUG   SplitRunner-20240604_095351_00000_crysi.0.0.0-1-97      software.amazon.awssdk.utils.cache.CachedSupplier       (StsAssumeRoleWithWebIdentityCredentialsProvider()) Refreshing cached value.

It is using software.amazon.awssdk.auth.credentials.AwsCredentialsProviderChain but for the STS client.
Further in logs:

2024-06-04T09:53:59.705Z        DEBUG   SplitRunner-20240604_095351_00000_crysi.0.0.0-1-97      software.amazon.awssdk.services.sts.auth.StsCredentialsProvider Using STS credentials with expiration time of 2024-06-04T10:53:59Z
2024-06-04T09:53:59.706Z        DEBUG   SplitRunner-20240604_095351_00000_crysi.0.0.0-1-97      software.amazon.awssdk.auth.credentials.AwsCredentialsProviderChain     Loading credentials from WebIdentityTokenCredentialsProvider()

[nineinchnick]

@ebyhr could you merge this?