Add CloudShell and environment variable credential support

[dap0am]

Summary

• Implements CloudShell metadata endpoint support using IMDSv2-like flow at localhost:1338
• Adds support for standard AWS environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
• Integrates both credential providers into the existing credential chain with comprehensive test coverage

Changes

• CloudShell support: Token-based authentication flow for CloudShell metadata endpoint
• Environment variables: Support for AWS credential environment variables with optional session token
• Testing: 12 new comprehensive tests covering success/failure scenarios for both credential methods
• Integration: Seamless integration into existing credential provider chain without breaking changes

Test Results

All tests pass (32 total: 20 existing + 12 new)

Test plan

• Unit tests for CloudShell credential retrieval (success/failure scenarios)
• Unit tests for environment variable credential retrieval (with/without session token)
• Integration tests confirming both methods work in the main credential chain
• Existing tests continue to pass with mock updates
• Manual testing in development environment

Fixes #285