Add a way to specify different credentials for inputDirURI/outputDirURI

When running the jobSpec, we may have a case where input/output uri belongs to a different bucket and need the separate credentials.

```
inputDirURI: 's3://bucketA/data/'
outputDirURI: 's3://bucketB/pinot/segments'
```

In some push mode, the outputDirURI is hidden behind the controller (in this case, controller config will have the credentials to the deep storage); however, if we use metadata push, we need to know the credentials for both since the write happens within the jobSpec executor.

Requirement:
- Add a way to specify credentials for both input/outputDirURi.
- When the metadata push is used, we should support the executor to be able to download source from one bucket and write the result to another bucket.

Start by tracing how jobSpec handles inputDirURI and outputDirURI, including the metadata push path in the executor and the controller's deep-storage configuration. Identify the existing credential configuration and related tests; done means metadata push can download from one bucket and write to another using separately specified credentials.

Written by the indexing model from the issue text.