Add external secret config and custom endpoint/token-exchange to oauth2 credential provider

[aidandaly24]

Stacked on top of your hashicorp#48517. This adds the remaining CreateOauth2CredentialProviderInput gaps that aren't covered by your PR, so aws_bedrockagentcore_oauth2_credential_provider reaches full parity with the SDK shape:

On all provider blocks:

• client_secret_source (MANAGED / EXTERNAL) + client_secret_config (secret_id, json_key) — reference an externally-managed AWS Secrets Manager secret for the client secret.

On custom_oauth2_provider_config:

• client_authentication_method (CLIENT_SECRET_BASIC / CLIENT_SECRET_POST / AWS_IAM_ID_TOKEN_JWT)
• on_behalf_of_token_exchange_config (+ nested token_exchange_grant_type_config) — RFC 8693 / RFC 7523 flows
• private_endpoint + private_endpoint_overrides — reuses the existing private-endpoint models from aws_bedrockagentcore_gateway_target

If you merge this into your branch, it rides along with hashicorp#48517.

Verified against aws-sdk-go-v2 service/bedrockagentcorecontrol v1.45.1.

Heads up on overlap: the on_behalf_of_token_exchange_config block here also exists in @rh0dy's hashicorp#48658. Whichever of these lands second will need a small rebase around that block — flagging so it's not a surprise. Happy to drop it here if you'd rather it come solely via hashicorp#48658.

Acceptance test

% make testacc TESTS='TestAccBedrockAgentCoreOAuth2CredentialProvider_(basic|included|customDiscoveryURL|customTokenExchange)' PKG=bedrockagentcore

--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_included (27.49s)
--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_basic (28.66s)
--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_customTokenExchange (28.91s)
--- PASS: TestAccBedrockAgentCoreOAuth2CredentialProvider_customDiscoveryURL (43.19s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/bedrockagentcore   43.362s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.