GH-50899: [CI][C++] Use OIDC instead of ACCESS_KEY and SECRET_KEY for sccache's s3 creds

[paultiq]

Rationale for this change

This PR moves crossbow builds to short-lived S3 credentials. It does this via GitHub's OIDC provider and an AWS ROLE_ARN with a trust relationship configured. This configuration is detailed here:

• Use IAM roles to connect GitHub Actions to actions in AWS

The benefits of short-lived / temporary credentials discussed further here: AWS Well-architected Framework Best Practices SEC02-BP02 Use temporary credentials

sccache supports a variety of S3 creds: S3 credentials

What changes are included in this PR?

Use AssumeRoleWithWebIdentity for sccache S3 credentials.

By assuming the AWS_ROLE_ARN, the sccache session relies on credentials that expire*, issued only to workflows in the trusted repository, and scoped to the sccache bucket.

Specific tasks:

• create a role in IAM with the bucket and object level permissions,
• trust the github oidc-provider,
• define AWS_ROLE_ARN and set id-token permission
• grant sts:AssumeRoleWithWebIdentity for the specific repositories or organization.
• pass AWS_SESSION_TOKEN
• add a aws-actions/configure-aws-credentials@v4 step to the workflow.

Separately, someone will need to add the role and trust to AWS:

• Procedure is in https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/
• Set a "Maximum session duration" to maximum runtime of any job... maybe 4 hours? 8 hours?
• Permissions: Role needs BucketLevel and ObjectLevels permissions to the bucket.

* I can share an example if needed

Are these changes tested?

Yes, locally and on a fork.

Are there any user-facing changes?

No

• GitHub Issue: [CI] assume AWS role via GitHub OIDC for sccache S3 #50899

[github-actions]

⚠️ GitHub issue #50899 has been automatically assigned in GitHub to PR creator.

[paultiq]

Per @kou 's comment #50899 (comment), leaving as draft.

I only made change to one workflow file. The other github.*.yml files will need the same change.

I tested this with archery crossbow submit test-ubuntu-24.04-cpp.