Add AWS password secret parser plugin

[Areson]

Why

Blip currently supports only the default RDS JSON shape for AWS Secrets Manager password payloads, so embedders with custom secret formats need to replace the whole DB factory to customize credential parsing.

What

• Add Plugins.ParsePasswordSecret for mapping raw SecretString or SecretBinary bytes onto blip.Secret
• Keep aws.Secret.GetSecret source-compatible and add GetSecretPayload for raw secret bytes
• Use the parser in the Secrets Manager credential reload path while preserving default username/password behavior
• Add parser and credential-path tests, and update AWS/config/integration docs

References

Validated with:

go test ./... -run 'TestDefaultPasswordSecretParser|TestPasswordSecretCredentialFunc|^$'

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[daniel-nichter]

:stamp:

...

Wait a minute! I don't work for you any longer! :-D

/me goes back to chopping wood

[Areson]

/me goes back to chopping wood

Thanks for the stamp Hemingway!