feat(auth): add AWS security credentials supplier support

Add a programmatic AWS external account builder that accepts caller-provided AWS region and security credentials. This lets applications delegate AWS credential resolution to the AWS SDK while google-cloud-auth builds the AWS subject token and performs the Google token exchange.

Also add supplier-path tests and censor sensitive AWS credential fields in Debug output.

Author: Linkgoron