feat: implement AWS temporary session based interactions

Description

Implement support for AWS session tokens to enable temporary, role-based interactions with S3-compatible backends. To maintain a seamless user experience, aliases utilizing expired session tokens will be automatically pruned from the configuration upon detection.

Requirements

• Core Alias Updates: Update the Alias configuration to support an optional session token using #[serde(default)] for backward compatibility.
• Security: Implement a custom fmt::Debug for the Alias struct to ensure session tokens and secret keys are scrubbed from logs.
• Credential Injection: Modify S3Client and AdminClient to inject the session token into the AWS credentials provider.
• Error Handling: Introduce a TokenExpired(String) error variant and map AWS ExpiredToken / InvalidToken errors to it.
• CLI Auto-Pruning: Intercept TokenExpired errors at the CLI boundary to log a clear message, automatically remove the dead alias from config.toml, and exit gracefully.

Acceptance Criteria

• rc alias set supports a new --session-token flag.
• Configuration changes include a schema_version bump and a migration path (migrations/).
• schemas/output_v2.json is updated to include the session_token field in the aliasInfo definition.
• Static credentials continue to function normally when the session token is omitted.
• CLI correctly identifies an expired token, logs a helpful warning, deletes the alias, and exits with AUTH_ERROR (Code 4).
• Debug/verbose logs strictly mask the session token as ***REDACTED***.
• Golden tests are successfully regenerated (UPDATE_GOLDEN=1 cargo test --features golden) and pass.
• Pre-commit checks (cargo fmt --all, cargo clippy --workspace -- -D warnings) pass with zero warnings.

Notes

This change impacts the Alias struct in crates/core, triggering the Breaking Change process outlined in AGENTS.md. The aws-sigv4 crate automatically handles the X-Amz-Security-Token header during request signing.

crates/core の Alias 構造体から始め、breaking change のプロセスについて AGENTS.md を読んでください。S3Client、AdminClient、CLI で alias を設定するエントリーポイント、migrations/、schemas/output_v2.json を追跡し、その後 golden tests を調べてください。session-token の設定、期限切れ処理、redaction、migration、schema の更新、および記載された cargo チェックがすべて通れば完了です。