Cover the AWS authorization-denial wire format with a committed test

Follow-up from #26898.

`AWSAuthorizationFailureDetector.TERMINAL_ERROR_CODES` keys on exact AWS error-code strings, but no committed test proves that a real DynamoDB or Kinesis IAM denial unmarshals to one of them, nor that the SDK invokes `onExecutionFailure` at all for an HTTP 400 on an async client configured the way `KinesisConsumer.createClientBuilders` configures it. Every existing case builds its own `AwsErrorDetails`.

The consequence is that the codes could be changed or mistyped without any test contradicting it, and an SDK upgrade that alters error-code derivation (`AwsJsonErrorCodeParser` strips the `com.amazon.coral.service#` prefix) would break detection silently.

This was verified manually during #26898 against a Docker-based emulator harness, but that harness is not committable: it needs Docker, waits out the real two-minute window, and its in-process HTTP proxy trips the `jdk-non-portable` forbidden-API check.

A cheaper committed variant is available. `mockwebserver3` is already test-scoped in `graylog2-server/pom.xml` with several existing users. Pointing a real `DynamoDbAsyncClient` with an `endpointOverride` at a MockWebServer that returns

```
400 {"__type":"com.amazon.coral.service#AccessDeniedException","message":"... not authorized to perform: dynamodb:Query ..."}
```

together with the detector's existing injectable clock, gives a sub-second test that covers the real error-code unmarshalling, that the SDK actually calls the interceptor hook, and the exception shape handed to `context.exception()` (which would also settle whether the defensive cause-chain walk is needed at all). Adding one success response first covers `afterExecution` firing only on success.

Start with AWSAuthorizationFailureDetector.TERMINAL_ERROR_CODES and KinesisConsumer.createClientBuilders, then inspect the mockwebserver3 test dependency in graylog2-server/pom.xml and AwsJsonErrorCodeParser behavior. Use MockWebServer with a real DynamoDbAsyncClient and endpointOverride, first covering a success response and then the documented HTTP 400 denial. Done means the test verifies error-code unmarshalling, interceptor hook invocation, and the exception exposed through context.exception().

Written by the indexing model from the issue text.