[FEATURE REQUEST] - Support S3 STS AssumeRoleWithWebIdentity for on‑prem S3 providers

### Is your feature request related to a problem? Please describe.

Polaris currently supports S3 access via STS AssumeRole (role ARN + optional external ID). Please add first‑class support for STS AssumeRoleWithWebIdentity (ARWI). Many enterprise S3‑compatible object stores deployed on‑prem rely on OIDC federation and expose an STS endpoint that accepts ARWI, rather than operating a native IAM service. Examples include Pure Storage FlashBlade, or Dell S3 storage among others. Adding ARWI unlocks secure, short‑lived, IdP‑federated access to S3‑compatible stores without long‑lived keys.

On‑prem S3 providers often delegate authentication to external IdPs (Okta, Microsoft Entra ID, etc.) and expect clients to obtain credentials via AssumeRoleWithWebIdentity to their STS endpoint. Polaris today documents role‑arn/region/external‑id and custom S3/STS endpoints, but not ARWI. Supporting ARWI would let Polaris run in OIDC‑first environments (Kubernetes, corporate SSO) and still vend short‑lived credentials to engines.

### Describe the solution you'd like

Add a storage auth selector for S3 catalogs, e.g. stsAuthMethod with values:
- assumeRole (current default/behavior)
- webIdentity (new)

When stsAuthMethod=webIdentity:
- Use AWS SDK’s ARWI credentials provider (e.g., StsAssumeRoleWithWebIdentity… in AWS SDK v2) against the configured sts-endpoint (already supported). ([polaris.incubator.apache.org](https://polaris.incubator.apache.org/in-dev/unreleased/command-line-interface/?utm_source=openai))
- Accept inputs via CLI and REST model:
- role-arn (unchanged)
- role-session-name (optional)
- web-identity-token-file (path to OIDC/JWT file)
- region (optional; also allow via env)
- sts-endpoint (already documented)

### Describe alternatives you've considered

_No response_

### Additional context

Default remains stsAuthMethod=assumeRole; existing catalogs and clients are unaffected.
IMPLICIT mode continues to work; ARWI simply adds another supported path to obtain base credentials.

Ref:
https://support.purestorage.com/bundle/FlashBlade_Admin_Guide_4.6.4/resource/FlashBlade_Admin_Guide_4.6.4.pdf (p.462)

https://support.purestorage.com/bundle/m_purityfb_rest_api/page/FlashBlade/Purity_FB/PurityFB_REST_API/S3_Object_Store_REST_API/topics/concept/c_flashblade_object_store_documentation_s3_api.html

Start by tracing the existing S3 catalog AssumeRole configuration through the CLI and REST model, then review the AWS SDK v2 STS provider options for AssumeRoleWithWebIdentity and the configured STS endpoint. Done means webIdentity accepts the listed inputs, preserves assumeRole as the default, and leaves existing catalogs and IMPLICIT mode unaffected.

Written by the indexing model from the issue text.