feat: add awsenv/secretsmanager package for Secrets Manager support #minor

[svvitale]

Summary

Adds a new awsenv/secretsmanager subpackage implementing awsenv.ParamsGetter
backed by AWS Secrets Manager (aws-sdk-go-v2). Mirrors the existing awsenv/v2
SSM adapter pattern.

• NewParamsGetter(client SecretsManagerAPI) awsenv.ParamsGetter — returns the
  interface directly, consistent with awsenv/v2
• MustReplaceEnv() — zero-config entry point, matches awsenv/v2 signature
  exactly (no args, uses awsenv.DefaultPrefix and context.Background())
• GetParams fetches secrets concurrently via errgroup; binary secrets
  (nil SecretString) return an error
• SecretsManagerAPI interface requires only GetSecretValue, enabling mock
  injection in tests
• Extracts mustReplaceEnvWithGetter helper in both awsenv/secretsmanager
  and awsenv/v2 to enable unit testing of MustReplaceEnv without live AWS

Usage

import (
    "github.com/sendgrid/aws-env/awsenv/secretsmanager"
)

// Zero-config (uses awsenv.DefaultPrefix = "awsenv:")
secretsmanager.MustReplaceEnv()

// Custom prefix via manual wiring
import (
    awsV2Config "github.com/aws/aws-sdk-go-v2/config"
    awssm "github.com/aws/aws-sdk-go-v2/service/secretsmanager"
    "github.com/sendgrid/aws-env/awsenv"
    "github.com/sendgrid/aws-env/awsenv/secretsmanager"
)

awsCfg, _ := awsV2Config.LoadDefaultConfig(ctx)
replacer := awsenv.NewReplacer("awssecret:", secretsmanager.NewParamsGetter(awssm.NewFromConfig(awsCfg)))
replacer.ReplaceAll(ctx)

Test plan

• 7/7 table-driven tests for GetParams pass with -race -count=1
  (single secret, multiple secrets, empty slice, nil slice, duplicate names,
  client error, nil SecretString)
• 3/3 tests for MustReplaceEnv via mustReplaceEnvWithGetter
  (replace, panic-on-error, no-op)
• 3/3 tests for awsenv/v2 MustReplaceEnv via mustReplaceEnvWithGetter
• Full ./... suite passes with no regressions

🤖 Generated with Claude Code