Document unattended credential acquisition

[alukach]

Alongside.

Do
One page per environment covering how to get credentials, how they refresh, how long they last, and what failure looks like when refresh is skipped.

Environments to cover:

• GitHub Actions (ambient OIDC, no stored secret)
• Anything else, via an API key

Watch
State plainly that aws-actions/configure-aws-credentials does not currently work against /.sts, and show the SDK web-identity provider setup instead.

---

Part of source-cooperative/source.coop#491.