feat(oss): support cross-account assume role credentials

[c1trua]

Background

The new test environment will run on ECS in a different Alibaba Cloud account, while continuing to access OSS in the original account. The existing OSS credential implementation only supports static credentials and same-account ECS RAM Role credentials, so it cannot support the required cross-account role chain.

Main Changes

• Added OSS credential mode ecs_ram_role_assume_role.
• Added OSS AssumeRole configuration fields for target role ARN, session name, ExternalId, STS endpoint, and session duration.
• Implemented the ECS RAM Role -> STS AssumeRole -> OSS temporary credentials flow.
• Kept existing static and ecs_ram_role behavior unchanged.
• Updated config examples and environment variable examples.
• Added tests for config loading and OSS credential validation.

Impact

• Existing deployments using static or ecs_ram_role are not expected to change behavior.
• The new flow is only enabled when oss.credential_mode is set to ecs_ram_role_assume_role.
• No database migration, OpenAPI, or sqlc-generated code changes are included.
• Windows local builds still do not support ECS metadata credential modes and return explicit errors.

Verification

Local checks completed:

• make -f Makefile/makefile fmt: passed
• make -f Makefile/makefile lint: passed
• make -f Makefile/makefile test: passed
• make -f Makefile/makefile it: passed
• go test ./internal/config ./internal/platform/oss: passed
• GOOS=linux go test -c -o NUL ./internal/platform/oss: passed
• git diff --check: passed