InvalidClientTokenId: The security token included in the request is invalid

When using the Terraform Boundary provider, we ran into an issue where the host catalog credentials cannot cycle because the old one is somehow missing.

Terraform Plan:

```
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# boundary_host_catalog_plugin.boundary will be updated in-place
~ resource "boundary_host_catalog_plugin" "boundary" {
id = "hc_ol8km8ltYy"
~ internal_force_update = "5577006791947779410" -> (known after apply)
~ name = "" -> "boundary-hosts"
# (9 unchanged attributes hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.

Job succeeded
```

Terraform Apply:

```
Terraform Cloud has been successfully initialized!
$ cd boundary && terraform apply -input=false tfplan
boundary_host_catalog_plugin.boundary: Modifying... [id=hc_ol8km8ltYy]
╷
│ Error: error updating host catalog: {"kind":"Internal","message":"host_catalogs.(Service).updatePluginInRepo: unable to update host catalog: plugin.(Repository).UpdateCatalog: in hc_ol8km8ltYy: db.DoTx: plugin.(Repository).UpdateCatalog: unknown, unknown: error #0: rpc error: code = Unknown desc = error attempting to replace credentials: error deleting old access key: InvalidClientTokenId: The security token included in the request is invalid.\n\tstatus code: 403, request id: df801b17-dedf-4860-bf8d-b6d711476c84"}
│
│ with boundary_host_catalog_plugin.boundary,
│ on hosts.tf line 18, in resource "boundary_host_catalog_plugin" "boundary":
│ 18: resource "boundary_host_catalog_plugin" "boundary" {
│
╵
ERROR: Job failed: exit code 1
```

I've tried manually deleting the Boundary user from IAM and rerunning plan and deploy a couple times to no avail. I don't know how to solve this without running a terraform destroy.

Start with hosts.tf line 18 and reproduce the Terraform plan/apply shown in the issue. Trace the host-catalog update path named in the error, especially credential replacement and deletion of the old access key. Done means a host catalog update can cycle credentials without returning InvalidClientTokenId.

Written by the indexing model from the issue text.