PREQ-3880 AWS credentials refactor

[mikolaj-matuszny-ext-sonarsource]

• Replaced static cache credentials with a credential_process-backed AWS profile to avoid leaking credentials into user steps.
• Added cache-credential-process.sh to fetch short‑lived Cognito credentials on demand (OIDC → Cognito).
• Updated action.yml to register the gh-action-cache profile in ~/.aws/config and scope AWS env vars to the cache step only.
• Ensured cache step uses AWS_SDK_LOAD_CONFIG=1 with AWS_PROFILE/AWS_DEFAULT_PROFILE=gh-action-cache so runs-on/cache post step can still authenticate.
• Hardened the credential process script with dependency checks and timeouts to prevent silent hangs.

Testing in runs 2 (create) and 3 (restore) in https://github.com/SonarSource/re-service-config/actions/runs/21628716053/job/62335779648