feat(cli): allow customizing role session name via CDK_ROLE_SESSION_NAME

[UTKARSH698]

Closes #1120

When the CDK CLI assumes a role (e.g. cdk-hnb659fds-deploy-role), it currently hard-codes the STS role session name to aws-cdk-<username>. When deployments run from a shared CI/CD pipeline this makes CloudTrail attribution unhelpful, since every deployment shows the same machine user.

This adds an opt-in CDK_ROLE_SESSION_NAME environment variable that overrides the session name when set, falling back to the existing aws-cdk-<username> default when unset. The variable name follows the CDK_ env var naming convention.

Notes

• This revives the approach from feat(cli): allow customizing role session name (#21012) aws-cdk#22631, which passed its build but was auto-closed for author inactivity rather than rejected on merit.
• The change lives in toolkit-lib'''s SdkProvider.withAssumedRole; reading an env var here is consistent with the surrounding awscli-compatible.ts, which already reads AWS_PROFILE, AWS_REGION, etc.

Testing

• Added a unit test asserting that CDK_ROLE_SESSION_NAME overrides the default session name, alongside the existing default/sanitization tests.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.

[mrgrain]

CDK env vars must start with CDK_.

What is the reason to use an env var over a cli flag? Or both? (You might be right, but I would like to see weighing up the options here.)

[UTKARSH698]

Thanks for the review @mrgrain.

Naming: Renamed AWS_CDK_ROLE_SESSION_NAME -> CDK_ROLE_SESSION_NAME to follow the CDK_ convention. Updated the code, the unit test, and the README env-var section (pushed in 0025193).

Env var vs CLI flag: A few reasons I leaned to an env var here, though I'm happy to add a flag too if you'd prefer:

• The role session name is ambient, per-environment context ("which pipeline/runner is assuming this role"), set once for the environment rather than per command. That maps naturally onto an env var, the same way CDK_DEFAULT_ACCOUNT / CDK_DEFAULT_REGION already work.
• The main motivation is CloudTrail attribution in CI/CD, where it should apply to every cdk invocation (deploy, diff, bootstrap, ...). With an env var you set it once in the job; a flag would have to be threaded onto every command.
• It also keeps parity with toolkit-lib's existing env-driven auth config (AWS_PROFILE, AWS_REGION, etc. via awscli-compatible.ts).

A CLI flag would be the better fit for per-invocation overrides. If you'd like both, I'm glad to add --role-session-name with the flag taking precedence over the env var. Let me know which direction you prefer and I'll update.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.13%. Comparing base (6dc2f75) to head (6805d87).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1672      +/-   ##
==========================================
- Coverage   89.14%   89.13%   -0.02%     
==========================================
  Files          77       77              
  Lines       11539    11539              
  Branches     1605     1606       +1     
==========================================
- Hits        10287    10285       -2     
- Misses       1221     1223       +2     
  Partials       31       31              

Flag	Coverage Δ
suite.unit	89.13% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.