Implement validateAccessToLocations for S3 Tables storage integration

## Summary

`AwsS3TablesCredentialsStorageIntegration.validateAccessToLocations()` currently returns an empty map (no-op). This method is called during catalog creation to verify that the configured IAM role can actually access the storage locations. For S3 Tables, this would mean verifying the role can reach the table bucket ARN.

## Context

The S3 Tables credential vending integration is being added in PR #4052. The `validateAccessToLocations` stub was intentionally deferred because:
- S3 Tables uses ARN-based resources, not path-based, and the existing S3 validation logic (which does a test `GetObject`/`PutObject`) doesn't apply
- Validation would likely require calling `s3tables:GetTableBucket` or `sts:AssumeRole` with a test policy to confirm access
- The scope of validation needs design discussion (validate at catalog creation? at first loadTable? both?)

## Acceptance Criteria

- [ ] When a catalog with `StorageType.S3_TABLES` is created, validate that the configured role ARN can be assumed and has access to the table bucket ARN
- [ ] Return meaningful validation results (not empty map) so catalog creation fails fast on misconfiguration
- [ ] Add unit tests for validation success and failure cases

## Related

- PR #4052 (S3 Tables credential vending)
- Issue #577 (S3 Tables integration)

### Describe the solution you'd like

_No response_

### Describe alternatives you've considered

_No response_

### Additional context

_No response_

Start with AwsS3TablesCredentialsStorageIntegration.validateAccessToLocations() and the existing S3 validation logic referenced in the issue; review PR #4052 and the design questions around catalog creation versus first loadTable. Define the validation behavior for the role ARN and table bucket ARN, then add unit tests for success and failure so catalog creation reports misconfiguration instead of returning an empty map.

Written by the indexing model from the issue text.