BrowserIdcAuthPlugin fails with ExpiredTokenException on CreateToken in ODBC 2.1.17

After upgrading from ODBC driver 2.1.12 to 2.1.17, BrowserIdcAuthPlugin connections fail with ExpiredTokenException during the CreateToken step. The browser authentication completes successfully (auth code is received), but the subsequent token exchange is rejected by AWS.

Steps to reproduce:

Configure ODBC DSN with plugin_name=BrowserIdcAuthPlugin, issuer_url, idc_region=us-west-2
Target: Redshift Serverless workgroup
Attempt connection from ODBC Administrator or any ODBC client
Expected: Connection succeeds (works on 2.1.12)

Actual: 403 ExpiredTokenException: "The security token included in the request is expired"

Environment:

Windows 10
ODBC Driver 2.1.17 (fresh install after full uninstall + reboot)
IAM Identity Center, us-west-2
Redshift Serverless
No AWS environment variables set
Same DSN configuration works on 2.1.12
Log evidence:

RegisterClient succeeds (fresh, not from cache)
Browser opens, user authenticates, auth code received
FetchAccessToken → CreateToken fails immediately with 403 ExpiredTokenException
No delay or timeout — response comes back in ~130ms
Analysis: The CreateToken OIDC API should be an unauthenticated call (using only client_id + client_secret). The "security token expired" error suggests the request is being incorrectly signed with AWS credentials by the underlying AWS SDK, or there's a regression in how the request is constructed in 2.1.17.

Workaround: Roll back to ODBC 2.1.12.

Start at the FetchAccessToken and CreateToken request path, then compare the request construction between ODBC 2.1.12 and 2.1.17, checking the AWS SDK signing behavior. Done means the BrowserIdcAuthPlugin flow succeeds for the described Redshift Serverless DSN without the ExpiredTokenException, while the existing 2.1.12 behavior remains the reference.

Written by the indexing model from the issue text.