Add support for AWS_CONTAINER_CREDENTIALS_FULL_URI (EKS Pod Identity Agent)

## Summary Extends the container credentials provider to support `AWS_CONTAINER_CREDENTIALS_FULL_URI` and the optional authorization token environment variables (`AWS_CONTAINER_AUTHORIZATION_TOKEN`, `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE`). This allows applications to obtain credentials when running with **AWS EKS Pod Identity Agent** or other credential endpoints that use a full URI and bearer token (e.g. [AWS Greengrass Token Exchange](https://docs.aws.amazon.com/greengrass/v2/developerguide/token-exchange-service-component.html), custom sidecars). ## Why this is important - **EKS Pod Identity** is the recommended way to give pods on Amazon EKS access to AWS APIs without IRSA or instance roles. The [EKS Pod Identity Agent](https://docs.aws.amazon.com/eks/latest/userguide/pod-id-agent-setup.html) runs as a DaemonSet and exposes credentials at a fixed endpoint (`http://169.254.170.23/v1/credentials`). The agent expects the client to set: - `AWS_CONTAINER_CREDENTIALS_FULL_URI` to that URL - `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE` (or `AWS_CONTAINER_AUTHORIZATION_TOKEN`) with the pod identity token - Without `FULL_URI` support, `Credentials::default()` (and the rest of the chain) never considers the container provider when only these env vars are set, so pods using EKS Pod Identity get `NoCredentials` and cannot call S3 or other AWS services with this crate. ## Prior work This builds on the container credentials support added in **[Priorize ECS/EKS credentials over EC2's when available (PR #441)](https://github.com/durch/rust-s3/pull/441)**. That PR introduced `from_container_credentials_provider()` and prioritized it over EC2 instance metadata, but only for `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` (used by ECS task IAM roles). This change adds the `FULL_URI` path and authorization token handling so both ECS-style and EKS Pod Identity–style container credentials are supported by the same provider. ## Changes - **`aws-creds/src/credentials.rs`** - `from_container_credentials_provider()` now: 1. Uses `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` if set (unchanged; builds `http://169.254.170.2{path}`). 2. Otherwise uses `AWS_CONTAINER_CREDENTIALS_FULL_URI` if set. - When using `FULL_URI`, the request optionally includes an `Authorization` header: - Token is read from `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE` (file path) if set. - Otherwise from `AWS_CONTAINER_AUTHORIZATION_TOKEN`. - New helper `get_container_authorization_token()` implements the token lookup (file precedence over env). - **Tests** (same file, `#[cfg(feature = "http-credentials")]`): - `test_container_credentials_not_container_when_no_env` – neither URI set → `NotContainer`. - `test_container_credentials_relative_uri_precedence` – both set → RELATIVE_URI is used. - `test_container_credentials_full_uri_used_when_no_relative` – only FULL_URI set → that URL is used. - `test_get_container_authorization_token_from_file` – token read from file. - `test_get_container_authorization_token_from_env` – token from env var. - `test_get_container_authorization_token_file_precedence` – file overrides env. ## Environment variables (after this PR) | Variable | When used | Purpose | |----------|-----------|---------| | `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` | Checked first | Path only; host is `169.254.170.2` (ECS task role). | | `AWS_CONTAINER_CREDENTIALS_FULL_URI` | If RELATIVE_URI unset | Full URL (e.g. EKS Pod Identity Agent). | | `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE` | When using FULL_URI | Path to file containing token for `Authorization` header. | | `AWS_CONTAINER_AUTHORIZATION_TOKEN` | When using FULL_URI, if _FILE unset | Token value for `Authorization` header. | Behavior matches the [AWS SDK / container credential provider](https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html) (RELATIVE_URI precedence, FULL_URI, optional auth token). ## Testing - `cargo test -p aws-creds --features http-credentials` – all new and existing tests pass. - No change to the default credential chain order; container provider remains after env/profile/STS and before instance metadata. <!-- Reviewable:start --> - - - This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/durch/rust-s3/449) <!-- Reviewable:end --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added container authorization token support and EKS Pod Identity credential source. * **Improvements** * Flexible container metadata source selection with clearer precedence and improved credential handling for containerized deployments. * **Tests** * Added tests covering container credential flows and token-source precedence (file vs environment). <!-- end of auto-generated comment: release notes by coderabbit.ai -->