fix(amazon-bedrock): do not inherit env AWS_SESSION_TOKEN with explicit keys

[giulio-leone]

Summary

Fixes #14136

When both accessKeyId and secretAccessKey are provided as explicit options to createAmazonBedrock, the sessionToken is now sourced only from options.sessionToken. Previously, loadOptionalSetting would unconditionally fall back to process.env.AWS_SESSION_TOKEN, which on hosts with workload identity (EKS IRSA, ECS task role, Lambda) belongs to a different principal — producing mixed, invalid SigV4 credentials:

"The security token included in the request is invalid."

Changes

• packages/amazon-bedrock/src/bedrock-provider.ts — When options.accessKeyId and options.secretAccessKey are both explicitly provided, use options.sessionToken directly instead of falling through to loadOptionalSetting (which reads AWS_SESSION_TOKEN from the environment). When keys come from the environment, env session-token fallback is preserved.
• packages/amazon-bedrock/src/bedrock-provider.test.ts — Three regression tests exercising the credential-resolution callback:
  1. Explicit keys → env AWS_SESSION_TOKEN is not inherited
  2. Explicit keys + explicit sessionToken → works correctly
  3. No explicit keys → env AWS_SESSION_TOKEN fallback is preserved

Behaviour matrix

accessKeyId	secretAccessKey	sessionToken option	AWS_SESSION_TOKEN env	Result
explicit	explicit	omitted	set	✅ sessionToken = undefined (no mixing)
explicit	explicit	explicit	set	✅ sessionToken = option value
from env	from env	omitted	set	✅ sessionToken = env value (preserved)

[aayush-kapoor]

closing in favour of #14832