profile credentials provider should support sts web identity as well

[TingDaoK]

Description of changes:

The profile credentials provider (aws_credentials_provider_new_profile) now supports web_identity_token_file as a credential source when role_arn is present but neither source_profile nor credential_source is specified.

Previously, s_create_sts_based_provider only handled two credential source paths for assume-role operations:

1. source_profile — resolve credentials from another profile
2. credential_source — resolve from environment (Ec2InstanceMetadata, Environment, EcsContainer)

If neither was set, the function returned NULL even when web_identity_token_file was configured in the profile. This broke common EKS/IRSA configurations where a profile chains through a web identity token:

[profile default]
role_arn = arn:aws:iam::111122223333:role/customer-role
source_profile = irsa-hop1

[profile irsa-hop1]
role_arn = arn:aws:iam::111122223333:role/intermediary-role
web_identity_token_file = /var/run/secrets/eks.amazonaws.com/serviceaccount/token

This PR adds a third branch: when role_arn is present and neither source_profile nor credential_source is set, check for web_identity_token_file and create an aws_credentials_provider_new_sts_web_identity provider as the credential source for the STS assume-role call.

Additional changes:

• Fixed the STS test mock to invoke request callbacks from s_aws_http_stream_activate_mock rather than from s_aws_http_connection_make_request_mock, ensuring callbacks fire after stream activation (matches real HTTP client behavior)
• Added priority-order documentation comments to s_create_sts_based_provider and s_credentials_provider_new_profile_internal

Testing:

• credentials_provider_profile_with_web_identity_config — single profile with role_arn + web_identity_token_file (no source_profile), exercises the new code path through the profile provider
• credentials_provider_sts_from_profile_config_with_web_identity_source — two-hop chain where default uses source_profile pointing to irsa-hop1 which has role_arn + web_identity_token_file

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.91%. Comparing base (ddb71ae) to head (ff08c8f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #298      +/-   ##
==========================================
+ Coverage   81.72%   81.91%   +0.19%     
==========================================
  Files          36       36              
  Lines        7134     7144      +10     
==========================================
+ Hits         5830     5852      +22     
+ Misses       1304     1292      -12     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[azkrishpy]

nit: seems like we have a convention of getting the different profile properties at the beginning.
Since we might be adding other providers to this profile soon might be better to make it an else if