fix: reuse the boto3 session to sign request

[wzxxing]

instead of creating a new session to sign every request

Summary

Changes

Please provide a summary of what's being changed

Previously, the httpx client factory creates a new aws session object to sign the request with sigv4. This works with plain credentials, but not with assume-role credentials provider, which uses a different session role name with timestamp when the credentials is assumed.

Since the owner of the MCP session is the actors User ID (in the form of <principal-id>:session-name>, the users creates a session (mcp initialize), but will fail the following up requests when trying to access the MCP session ID with a different role session name.

fixes: #117

User experience

Please share what the user experience looks like before and after this change

User should be able to user their aws profile with assume role credentials provider.

Checklist

If your change doesn't seem to apply, please leave them unchecked.

• I have reviewed the contributing guidelines
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented

Is this a breaking change? (Y/N)

• Yes
• No

Please add details about how this change was tested.

Tested with a profile with assume-role credentials

• Did integration tests succeed?
• If the feature is a new use case, is it necessary to add a new integration test case?

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[psantus]

I'll test when this is released, thanks for addressing my bug report!