Redshift driver: support AWS Identity Center trusted identity propagation for lake formation

**Is your feature request related to a problem? Please describe.**

Cube's Redshift driver uses `pg`, which can't carry an AWS Identity Center (IdC) identity into Redshift. So Redshift always sees the shared IAM role Cube connects with, never the real user. That kills Lake Formation policies tied to IdC users/groups — even when trusted identity propagation is fully set up on AWS, Cube is the ceiling.

**Describe the solution you'd like**

A `dataApi: true` mode that swaps `pg` for `@aws-sdk/client-redshift-data`. The SDK supports IdC trusted identity propagation natively, so Redshift sees the real user and LF policies just work. Same pattern as the existing Athena driver.

**Describe alternatives you've considered**

- `dataSources` multi-role routing: per-group only, no user identity.
- Bypass Cube via Data API directly: loses the semantic layer.
- Custom driver fork: weeks of work, ongoing maintenance.

**Additional context**

[TIP for Redshift](https://docs.aws.amazon.com/singlesignon/latest/userguide/tip-usecase-redshift.html) · [Redshift IdC auth](https://docs.aws.amazon.com/redshift/latest/mgmt/identity-center-authentication.html) · [LF IdC integration](https://docs.aws.amazon.com/lake-formation/latest/dg/identity-center-integration.html). Affects anyone running Cube on JC/Okta/Entra → IdC → Redshift + LF. Happy to contribute a PR.