feat: enable AWS login credentials for Bedrock auth

[celia-oai]

Summary

Codex's Amazon Bedrock provider signs Mantle requests with SigV4 using credentials resolved by the AWS SDK. That worked for standard AWS profiles and environment credentials, but AWS CLI console-login profiles created by aws login require the SDK's credentials-login feature to resolve login_session credentials.

This change enables that credential provider so Bedrock can use AWS console-login credentials through the existing provider-owned AWS auth path.

While testing the console-login path, we also hit a Mantle-specific SigV4 regression from the new split between session_id and thread_id. Mantle does not preserve legacy OpenAI compatibility headers that use snake_case before SigV4 verification, so signing those headers can make the server reconstruct a different canonical request. The Bedrock auth path now removes that header class before signing, keeping preserved hyphenated Codex/AWS headers such as x-codex-turn-metadata signed normally.

Changes

• Enable aws-config's credentials-login feature in codex-rs/aws-auth.
• Add a compile-time regression test for aws_config::login::LoginCredentialsProvider.
• Strip snake_case compatibility headers from Bedrock Mantle SigV4 requests before signing.
• Expand the Bedrock auth regression test to cover session_id, thread_id, and future headers of the same shape.
• Refresh Cargo and Bazel lockfiles for the added aws-sdk-signin dependency.

Tests

• tested with aws login locally and verified that it works as intended.

[pakrym-oai]

is this the right filter? should we have an allowlist instead?

[celia-oai]

unfortunately non-standard headers just won't be accepted by aws anyways. I think it's a fine tradeoff for now, we can revisit it if we need to achieve header parity with out responses api down the road