feat: implement AWS temporary session based interactions

Comienza con la estructura Alias en crates/core y lee AGENTS.md para conocer el proceso de breaking changes. Sigue S3Client, AdminClient, el punto de entrada para establecer alias mediante la CLI, migrations/ y schemas/output_v2.json; después, inspecciona las pruebas golden. Se considera terminado cuando la configuración del token de sesión, el manejo de la expiración, la redacción, la migración, las actualizaciones del esquema y las comprobaciones de cargo indicadas pasan todas correctamente.

Description

Implement support for AWS session tokens to enable temporary, role-based interactions with S3-compatible backends. To maintain a seamless user experience, aliases utilizing expired session tokens will be automatically pruned from the configuration upon detection.

Requirements

• Core Alias Updates: Update the Alias configuration to support an optional session token using #[serde(default)] for backward compatibility.
• Security: Implement a custom fmt::Debug for the Alias struct to ensure session tokens and secret keys are scrubbed from logs.
• Credential Injection: Modify S3Client and AdminClient to inject the session token into the AWS credentials provider.
• Error Handling: Introduce a TokenExpired(String) error variant and map AWS ExpiredToken / InvalidToken errors to it.
• CLI Auto-Pruning: Intercept TokenExpired errors at the CLI boundary to log a clear message, automatically remove the dead alias from config.toml, and exit gracefully.

Acceptance Criteria

• rc alias set supports a new --session-token flag.
• Configuration changes include a schema_version bump and a migration path (migrations/).
• schemas/output_v2.json is updated to include the session_token field in the aliasInfo definition.
• Static credentials continue to function normally when the session token is omitted.
• CLI correctly identifies an expired token, logs a helpful warning, deletes the alias, and exits with AUTH_ERROR (Code 4).
• Debug/verbose logs strictly mask the session token as ***REDACTED***.
• Golden tests are successfully regenerated (UPDATE_GOLDEN=1 cargo test --features golden) and pass.
• Pre-commit checks (cargo fmt --all, cargo clippy --workspace -- -D warnings) pass with zero warnings.

Notes

This change impacts the Alias struct in crates/core, triggering the Breaking Change process outlined in AGENTS.md. The aws-sigv4 crate automatically handles the X-Amz-Security-Token header during request signing.