Use supplied credentials in AWS SDK client

[vimtor]

Closes #6888

• The aws4fetch client constructor previously only used env variables or ECS container credentials, ignoring any credentials passed through the aws options
• Update client() to accept optional AwsOptions and use accessKeyId/secretAccessKey from supplied options before falling back to env or container metadata
• Pass options?.aws from awsFetch() into client() so all SDK consumers (task, bus, workflow) inherit the fix