aws-vpc-move-ip fragile handling of credentials output from AssumeRole call

The `aws-vpc-move-ip` resource agent looks to have a bug due to the fragile handling output when making a `aws sts assume-role` call.

- https://github.com/ClusterLabs/resource-agents/blob/main/heartbeat/aws-vpc-move-ip#L392-L409
- https://github.com/ClusterLabs/resource-agents/blob/main/heartbeat/aws-vpc-move-ip#L238-L255

The way this is being done in the resource agent script, is extremely fragile:

```bash
...

execute_cmd_as_role(){
cmd=$1
role=$2
output="$($AWSCLI_CMD sts assume-role --role-arn $role --role-session-name AWSCLI-RouteTableUpdate --output=text)"
export AWS_ACCESS_KEY_ID="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $5}')"
export AWS_SECRET_ACCESS_KEY="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $7}')"
export AWS_SESSION_TOKEN="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $8}')"

#Execute command
ocf_log debug "Assumed Role ${role}"
ocf_log debug "$($OCF_RESKEY_awscli sts get-caller-identity)"
ocf_log debug "executing command: $cmd"
response="$($cmd)"
unset output AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
echo $response
}

...
```

when ideally it would do it via `--query`:

```bash
...

output="$($AWSCLI_CMD sts assume-role \
--role-arn "$role" \
--role-session-name AWSCLI-RouteTableUpdate \
--query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
--output text)"
rc=$?

...
```

```
diff --git a/heartbeat/aws-vpc-move-ip b/heartbeat/aws-vpc-move-ip
index 1348c59..233668c 100755
--- a/heartbeat/aws-vpc-move-ip
+++ b/heartbeat/aws-vpc-move-ip
@@ -238,18 +238,39 @@ END
execute_cmd_as_role(){
cmd=$1
role=$2
- output="$($AWSCLI_CMD sts assume-role --role-arn $role --role-session-name AWSCLI-RouteTableUpdate --output=text)"
- export AWS_ACCESS_KEY_ID="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $5}')"
- export AWS_SECRET_ACCESS_KEY="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $7}')"
- export AWS_SESSION_TOKEN="$(echo $output | awk -F" " '$4=="CREDENTIALS" {print $8}')"
+ output="$($AWSCLI_CMD sts assume-role \
+ --role-arn "$role" \
+ --role-session-name AWSCLI-RouteTableUpdate \
+ --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' \
+ --output text)"
+ rc=$?
+ if [ "$rc" -ne 0 ]; then
+ unset output
+ ocf_log err "Failed to assume role ${role}"
+ return "$rc"
+ fi

- #Execute command
+ set -- $output
+ if [ "$#" -ne 3 ] || [ -z "$1" ] || [ -z "$2" ] || [ -z "$3" ]; then
+ unset output
+ ocf_log err "Invalid credentials returned while assuming role ${role}"
+ return $OCF_ERR_GENERIC
+ fi
+
+ export AWS_ACCESS_KEY_ID="$1"
+ export AWS_SECRET_ACCESS_KEY="$2"
+ export AWS_SESSION_TOKEN="$3"
+ unset output
+
+ # Execute command
ocf_log debug "Assumed Role ${role}"
ocf_log debug "$($OCF_RESKEY_awscli sts get-caller-identity)"
ocf_log debug "executing command: $cmd"
response="$($cmd)"
- unset output AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
- echo $response
+ rc=$?
+ unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
+ printf '%s\n' "$response"
+ return "$rc"
}

ec2ip_set_address_param_compat(){
```

Docs:

- https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html#output
- https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html

Start in heartbeat/aws-vpc-move-ip, especially execute_cmd_as_role and its callers around the referenced lines. Review the AWS STS assume-role output documentation, then verify success, command-failure, and malformed-credentials paths; done means credentials are handled reliably, errors are returned, and the existing command output remains intact.

Written by the indexing model from the issue text.