feat: batch fetching for AWS Secrets Manager provider

[bdj]

Summary

• Override get_batch on AwssmProvider to use the AWS BatchGetSecretValue API, reducing N sequential GetSecretValue calls to ceil(N/20) batched calls
• For a project with 30 secrets, this reduces API calls from 30 to 2 and eliminates 29 redundant AWS SDK client constructions
• Handle ResourceNotFoundException in error array as "secret not present" (consistent with get() returning None), fail on other per-secret errors

IAM Note

Users need secretsmanager:BatchGetSecretValue permission in addition to the existing secretsmanager:GetSecretValue. The docs IAM policy example and changelog have been updated accordingly.

Test plan

• Unit tests for build_batch_request_names helper (empty, basic, chunking at 45 keys)
• Unit tests for format_secret_name edge cases (empty inputs, too long)
• Existing awssm tests still pass (URI parsing, provider creation)
• Full test suite passes (cargo test --all --features awssm)
• Integration test with real AWS credentials (SECRETSPEC_TEST_PROVIDERS=awssm cargo test --features awssm)

🤖 Generated with Claude Code