Support cross AWS account IAM role authentication

[munishchouhan]

Summary

• Add support for AWS IAM role assumption (STS AssumeRole) when authenticating to ECR registries, enabling cross-account container image access
• When Tower credentials contain an assumeRoleArn instead of static AWS keys, Wave now assumes that role via STS to obtain temporary ECR credentials
• Support optional jump role chaining (wave.aws.jump-role-arn) for cross-account access where Wave first assumes an intermediary role, then uses those credentials to assume the target role
• Cache STS temporary credentials and ECR auth tokens with TTL derived from STS credential expiration (5-minute refresh buffer)
• Retry transient STS errors (5xx, throttling) with exponential backoff via configurable StsClientConfig
• Handle ExpiredTokenException on the jump role path by bypassing cache and retrying with fresh credentials
• Map STS exceptions to user-friendly error messages

Key Changes

Production code:

• build.gradle — Promote software.amazon.awssdk:sts from runtimeOnly to implementation
• ContainerRegistryKeys.groovy — Parse assumeRoleArn/externalId from Tower AWS credentials (previously logged a warning and returned null)
• AwsEcrService.groovy — Add role ARN detection, STS AssumeRole with jump role chaining, credential caching, retry, and error mapping
• StsClientConfig.groovy — New configurable retry settings for STS calls (wave.aws.sts.retry.*)
• AwsRoleCache.groovy — New tiered cache for jump role temporary credentials
• AwsStsCredentials.groovy — Serializable wrapper for STS credentials (cache value)

Documentation:

• docs/configuration.md — Added configuration docs for cross-account role chaining, STS retry, and jump role cache
• CLAUDE.md — Added WAVE_AWS_JUMP_ROLE_ARN/WAVE_AWS_JUMP_EXTERNAL_ID environment variables

Design docs:

• specs/001-cross-account-iam-role-auth/ — Spec, plan, tasks, research, data model, service interface, and STS integration contracts

Tests:

• AwsEcrServiceTest.groovy — ~895 lines covering role detection, assume role flows, caching, retry, error mapping
• ContainerRegistryKeysTest.groovy — 304 lines covering assume role credential parsing

Configuration

New properties:

• wave.aws.jump-role-arn — Optional intermediary role ARN for cross-account chaining
• wave.aws.jump-external-id — Optional external ID for the jump role
• wave.aws.jump-role-cache.duration — Jump role cache TTL (default: 45m)
• wave.aws.jump-role-cache.max-size — Maximum cache entries for jump role credentials (default: 100)
• wave.aws.sts.retry.delay / maxDelay / attempts / multiplier / jitter — STS retry tuning

Test Plan

• Verify static AWS credentials flow still works (backward compatible)
• Test role ARN detection with standard, GovCloud (aws-us-gov), and China (aws-cn) partitions
• Test jump role chaining: Wave default creds → jump role → target role → ECR token
• Test direct role assumption (no jump role configured)
• Verify ExpiredTokenException retry bypasses jump role cache
• Verify STS transient error retry with backoff
• Verify ECR auth token cache TTL respects STS credential expiration minus 5-min buffer

[munishchouhan]

@pditommaso, changes have been made as per review
please review again

[munishchouhan]

@pditommaso This PR contains unverified commits, So i cannot merge it, please ,erge it
I did the final testing and aws creds are working fine