AWS IAM authentication: standalone artifact, STS role assumption, bundled RDS certificates

The AWS-IAM credential plugin will move out of the connector into its own artifact,
mariadb-java-client-aws (aws/ sub-project), so that the connector carries no AWS SDK dependency.
Users will add this artifact next to the connector; credentialType=AWS-IAM is otherwise unchanged.

New options: roleArn, roleSessionName, externalId. With roleArn the token will be signed with the
temporary credentials of that IAM role, assumed through STS.

The plugin will ship the RDS global certificate bundle. The default sslMode=verify-full will then
validate an RDS endpoint without any TLS option; serverSslCert and trustStore will keep precedence,
and the system trust store will stay trusted (RDS Proxy). This relies on a new
CredentialPlugin.defaultServerSslCert() hook in the connector.

To be tested against an RDS MariaDB instance (direct, STS role, certificate validation), with a
script recreating that environment.