[FEATURE] Add a WebSearch client to bedrock_agentcore.tools and a create_web_search_target() helper

**Is your feature request related to a problem? Please describe.**

`bedrock_agentcore.tools` ships first-class clients for two of the built-in tools:

- `browser_client.py` provides `BrowserClient`
- `code_interpreter_client.py` provides `CodeInterpreterClient`

Web Search has no equivalent, even though it is reachable today as a Gateway connector target. To run one search from Python a developer has to create a gateway, create a target whose `targetConfiguration.mcp.connector.source.connectorId` is `web-search` with the `WebSearch` operation enabled, attach a `GATEWAY_IAM_ROLE` credential provider, wait for the target to reach READY, and then call it over MCP with SigV4-signed requests. The comparable third-party search tools are an install and a key.

**Describe the solution you'd like**

Two additions, both following patterns that already exist in this repo.

1. `src/bedrock_agentcore/tools/web_search_client.py` with a `WebSearchClient`, shaped like the existing two clients in that package, so a search is one constructor and one call. The client owns the transport and the request signing, and keeps both as internal details that callers do not configure.

2. A `create_web_search_target()` helper on `GatewayClient`, directly analogous to the existing `create_knowledge_base_target()` at `src/bedrock_agentcore/gateway/client.py`. That method builds the `connectorId: "bedrock-knowledge-bases"` connector with `enabled: ["Retrieve"]` and a `GATEWAY_IAM_ROLE` credential provider, then delegates to `create_gateway_target_and_wait()`. The web search equivalent would build `connectorId: "web-search"` with `enabled: ["WebSearch"]` the same way. Generic target creation already works through `create_gateway_target_and_wait()`, so this is about a typed one-call helper rather than new capability.

The helper should also expose the filtering the connector supports. For reference, `aws/agentcore-cli` currently models only domain exclusion: `WebSearchTranslatorInput` in `src/cli/operations/connectors/translators.ts` has a single `excludeDomains` field and builds `parameterValues.domainFilter = { exclude: [...] }`. Domain inclusion is not exposed there.

**Describe alternatives you've considered**

Leaving each consumer to wire up Gateway and MCP itself. There are several that need the same thing: a Strands integration, a LangChain package, `aws/agentcore-cli`, the four framework examples in `aws/mcp-proxy-for-aws`, and the documentation. If each one builds its own path, every change to how a search is reached has to be repeated in all of them. One client in the SDK means it is done once.

**Additional context**

This repo already carries framework integrations for AgentCore capabilities under `/integrations/strands/`, and `pyproject.toml` has the `strands-agents` and `langgraph` extras wired for exactly that. A web search client here is the natural base for those.