feat(gateway-target): allow GATEWAY_IAM_ROLE outbound auth on mcpServer / openApiSchema targets (iamCredentialProvider)

Empieza con src/schema/schemas/mcp.ts y reproduce el problema con agentcore validate; después inspecciona el validador de flags y L3 buildCredentialConfig(). Comprueba también la tabla de Auth de --help y la lista de opciones de la TUI. La tarea estará terminada cuando la autenticación IAM se acepte y se emita correctamente para mcpServer y openApiSchema, se rechace donde no corresponda y el requisito de credenciales ya no se aplique a IAM ni a JWT passthrough.

Description

Gateway supports IAM outbound auth to MCP server and OpenAPI targets — the gateway signs with SigV4 via its service role. Per Set up outbound authorization for your gateway, these two target types take a GATEWAY_IAM_ROLE credential provider plus an iamCredentialProvider block (service required — bedrock-agentcore for MCP servers on AgentCore Runtime; region optional). Lambda / API Gateway / Smithy take the bare credentialProviderType with no iamCredentialProvider.

TARGET_TYPE_AUTH_CONFIG in src/schema/schemas/mcp.ts doesn't allow it: mcpServer is OAUTH | NONE, openApiSchema is OAUTH | API_KEY. Only passthrough gets GATEWAY_IAM_ROLE. So there's no way to put an IAM-auth MCP server hosted on AgentCore Runtime behind a gateway — it forces an OAuth provider in front of a runtime that already authenticates with SigV4.

It's a schema block, not just a missing flag — hand-editing agentcore.json fails too:

$ agentcore validate
  - agentCoreGateways[0].targets[0].outboundAuth:
    mcpServer targets do not support GATEWAY_IAM_ROLE outbound auth

Separately, the flag surface reports the wrong reason — the guard exempts only NONE, so GATEWAY_IAM_ROLE and JWT_PASSTHROUGH fall through into the OAuth credential requirement:

$ agentcore add gateway-target --type mcp-server --outbound-auth gateway-iam-role \
    --signing-service bedrock-agentcore ...
--credential-name or inline OAuth fields (--oauth-client-id, --oauth-client-secret,
--oauth-discovery-url) required when outbound auth type is gateway-iam-role

Acceptance Criteria

• TARGET_TYPE_AUTH_CONFIG allows GATEWAY_IAM_ROLE on mcpServer and openApiSchema, with service required there and rejected for Lambda / API Gateway / Smithy
• --signing-service / --signing-region accepted for these types, not just passthrough
• flag validator exempts GATEWAY_IAM_ROLE / JWT_PASSTHROUGH from the credential requirement
• L3 buildCredentialConfig() emits the iamCredentialProvider block for these types (today it returns undefined outside the passthrough branch — the #1005 failure shape)
• --help Auth table and TUI option list updated

Additional Context

• @aws/agentcore 0.28.1, @aws/agentcore-cdk 0.1.0-alpha.50, aws-cdk-lib 2.261.0.
• Reproduced at config / validate level only; I haven't run a live CreateGatewayTarget with this shape.
• Related: #1359 (same map, API_KEY). Note #1914/#1915 recorded "mcpServer supports only OAuth or none" — accurate to the validator, but the doc above allows IAM.