Feature/s3 bucket auth

[bsatoriu]

This PR adds organization-level S3 bucket access management, allowing admins to grant orgs access to custom S3 buckets/prefixes beyond the default user workspace.

When users request STS credentials via /api/members/self/awsAccess/workspaceBucket, the IAM policy now dynamically includes any custom S3 buckets their organizations have been granted, and the response returns an authorized_s3_paths array listing all accessible paths.

Endpoint response format change for awsAccess/workspaceBucket

The /api/members/self/awsAccess/workspaceBucket response replaces aws_bucket_name and aws_bucket_prefix with authorized_s3_paths (an array of s3:// URIs). Consumers that read aws_bucket_name/aws_bucket_prefix will need to be updated to use authorized_s3_paths[0] or iterate the full list.

Related admin console change: MAAP-Project/maap-wp-plugin@8c72f74

[sujen1412]

Can we include an example of how a user would use this using maap-py ?
The example could be in the function doc string in maap-py and a notebook on read the docs

[riverma]

@bsatoriu - check out my message on Slack for some automation that could help with @sujen1412 docs request.

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud