minor: Add new intermediate S3 role

[adarshsanjeev]

This pull request introduces support for configuring an intermediate AWS role to assume before the final role specified in S3 ingestion and export operations. This allows Druid clusters to use a fixed intermediate role, simplifying trust policies for S3 bucket owners.

• Added a new configuration property, druid.s3.intermediateAssumeRoleArn, which specifies an intermediate AWS role to assume before the final assumeRoleArn.

---

This PR has:

• been self-reviewed.
  • using the concurrency checklist (Remove this item if the PR doesn't have any relation to concurrency.)
• added documentation for new or modified features or behaviors.
• a release note entry in the PR description.
• added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
• added or updated version, license, or notice information in licenses.yaml
• added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
• added unit tests or modified existing tests to cover new code paths, ensuring the threshold for code coverage is met.
• added integration tests.
• been tested in a test Druid cluster.

[kgyrtkirk]

note: was just looking around; I know its a draft - but one thing caught my eye:

there are already some JacksonInject stuff already; couldn't it make sense to just reuse an exiting config instead of adding a new S3IntermediateRoleConfig and passing that to a lot of places?

[adarshsanjeev]

I was considering reusing AWSCredentialsConfig, but it's wasn't clear to me since it is not actually injected into all the classes I need. I would have to add it to places which might make it visible and, since it contains credentials, I figured I'd keep it separate in the initial PR.

[adarshsanjeev]

We already do have two classes bound to druid.s3 so it shouldn't break anything in terms of backward compatibility.