High volume of AssumeRoleWithWebIdentity calls from Polaris on EKS/IRSA

### Describe the bug We're running Polaris on EKS with IRSA, using the Kubernetes service account role as the Polaris AWS identity. While investigating STS usage, we noticed Polaris is making a lot of `AssumeRoleWithWebIdentity` calls for its own IRSA role. The calls are coming from the Java AWS SDK user agent and each call has a new `aws-sdk-java-<timestamp>` session name. The volume looks higher than expected for normal AWS SDK credential refresh behavior, so it seems like the WebIdentity credential provider/cache may not be getting reused across Polaris requests. ### To Reproduce 1. Run Polaris on EKS with IRSA. 2. Do not configure static AWS credentials for Polaris. 3. Send normal catalog traffic to an S3-backed catalog. 4. Query CloudTrail for `AssumeRoleWithWebIdentity` events on the Polaris service account role. I don't have a small local reproducer yet; the observations below are from two EKS deployments. ### Actual Behavior In one deployment, CloudTrail showed this pattern for the Polaris IRSA role: ```text Polaris version: 1.3.0-incubating Window: 2026-06-11T18:19:00Z to 2026-06-11T18:20:00Z Event: AssumeRoleWithWebIdentity Total events for the Polaris role: 1,261 By user agent: - aws-sdk-java/2.39.2 ... api/STS#2.39.x ... lang/java#21.0.9: 1,259 - aws-sdk-go-v2 ... app/external-secrets: 2 ``` A sanitized event looks like: ```json { "eventTime": "2026-06-11T18:19:00Z", "eventName": "AssumeRoleWithWebIdentity", "userAgent": "aws-sdk-java/2.39.2 ... api/STS#2.39.x ... lang/java#21.0.9", "roleArn": "arn:aws:iam::<account-id>:role/<polaris-irsa-role>", "roleSessionName": "aws-sdk-java-<timestamp>", "sourceIPAddress": "<redacted>" } ``` A second deployment showed the same shape at lower volume: ```text Window: 2026-06-11T18:10:00Z to 2026-06-11T18:20:00Z Total events for the Polaris role: 434 By user agent: - aws-sdk-java/2.39.2 ... api/STS#2.39.x ... lang/java#21.0.9: 412 - aws-sdk-go/...: 22 ``` ### Expected Behavior Polaris should reuse AWS WebIdentity credentials according to the normal AWS SDK refresh behavior. I would not expect ordinary catalog traffic to produce hundreds or thousands of `AssumeRoleWithWebIdentity` calls for the Polaris pod role in a short window. ### Additional context One possible area to check is the service identity path. In 1.3.0-incubating, `AwsIamServiceIdentityConfiguration.awsCredentialsProvider()` builds a `DefaultCredentialsProvider` when static credentials are not configured. If that path runs per request, the AWS SDK's WebIdentity credential cache may not be reused as intended. ### System information OS: Linux on EKS Java: 21 Polaris version: 1.3.0-incubating AWS SDK user agent observed: aws-sdk-java/2.39.2 Storage: AWS S3 Auth setup: EKS IRSA, no static AWS access keys configured for Polaris