[Feature] Support the InjectedIdentity credential source in terraform-controller

Support the InjectedIdentity credential source in terraform-controller, to enable use workload identity like [IRSA](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) - iam-roles for service accounts on AWS and [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) on Google Cloud.

Part of this implementation has been done by crossplane-runtime -
https://github.com/oam-dev/terraform-controller/blob/3b4fde8230fb1bf4c840e6b9691e37a291367731/api/types/crossplane-runtime/resource.go#L36

The CRD providers.terraform.core.oam.dev already support this - https://github.com/oam-dev/terraform-controller/blob/d89c4c2507e99add0afcfac6eb3539c0f88fc86b/config/crd/bases/terraform.core.oam.dev_providers.yaml#L62

Start with api/types/crossplane-runtime/resource.go and the existing provider CRD at config/crd/bases/terraform.core.oam.dev_providers.yaml, which the issue identifies as partial support for InjectedIdentity. Trace how the credential source is represented and consumed in terraform-controller. Done means providers can use workload identity credentials for the AWS and Google Cloud scenarios described.

Written by the indexing model from the issue text.