Refactor: Replaces 'get_federation_token' with 'assume_role' in 'external_creds()' for IAM Role-based S3 credential generation

[kellygavin96]

Background
Previously, external_creds() used permanent IAM User access keys stored in Secrets Manager (S3_AWS_ACCESS_KEY_ID / S3_AWS_SECRET_ACCESS_KEY) to call sts:GetFederationToken and generate scoped temporary credentials for S3 file uploads and downloads. This required long-lived secrets to be maintained and rotated across multiple AWS accounts.
This change replaces that pattern with sts:AssumeRole, which works with the existing ECS Fargate Task Roles and eliminates the need for any permanent IAM User credentials.

Addressing the concern

"You can't use a role to call get_federation_token"

Correct — but we don't need get_federation_token anymore. IAM Roles are already temporary. assume_role() does the same downscoping with the same inline Policy parameter and returns an identical Credentials object.

Code changes

Remove explicit IAM User key construction from boto3 STS client
Replace get_federation_token(Name=...) with assume_role(RoleArn=..., RoleSessionName=...)
Update response handling: FederatedUser → AssumedRoleUser
New env var: S3_UPLOAD_ROLE_ARN (role ARN to assume — replaces key pair)
Read S3_UPLOAD_ROLE_ARN from GAC (Secrets Manager) or environment variable
All policy construction, KMS handling, and credential packaging unchanged

Infrastructure changes applied per AWS account
Accounts: cgap-dbmi, 4dn, smaht-prod, smaht-wolf, cgap-mgb-prod, lzprod-cgap-production, cgap-dev-test

Created dedicated S3 Upload IAM Role (encoded-core-s3-upload) with scoped S3 and KMS permissions
Added ECS Task Roles to S3 Upload Role trust policy
Added sts:AssumeRole permission to ECS Task Roles targeting S3 Upload Role
Added S3_UPLOAD_ROLE_ARN to each account Secrets Manager secret

Testing
Standalone test script included: src/encoded_core/tests/test_assume_role_migration.py

✅ assume_role() returns correct credentials shape
✅ Scoped credentials allow upload and download to target key only
✅ Cross-key access denied (policy enforcement confirmed)
✅ Download-only credentials correctly block PutObject
✅ KMS encrypted buckets work with KMS actions in session policy
✅ No regressions in existing test suite

[kellygavin96]

"Closing in favor of (#26) which is branched directly off the upstream repo."