[SRA] Invalidate credentials caching when environment variables change

[dscpinheiro]

Description

This PR makes two changes to the DefaultAWSCredentialsIdentityResolver (which is the replacement for the FallbackCredentialsFactory in V4):

• If there are changes to environment variables used by our credentials provider (such as AWS_PROFILE), do not return cached credentials
• If a custom / non-default profile is specified and the profile doesn't exist, throw an error instead of going to the next provider in the credential chain (which at the moment is IMDS). With the previous behavior, customers running outside of EC2 would get a different error (Unable to get IAM security credentials from EC2 Instance Metadata Service) that wouldn't reference the invalid profile at all.

Motivation and Context

Internal issue: DOTNET-7855

Testing

• Dry-run: DRY_RUN-cf127d60-49ba-48a7-b0e9-04eecaa186c3
• Console app:

var s3Client = new AmazonS3Client();
var response1 = await s3Client.ListBucketsAsync();
Console.WriteLine($"Found {response1.Buckets.Count} buckets for default profile");

Environment.SetEnvironmentVariable("AWS_PROFILE", "test-runner");
var response2 = await s3Client.ListBucketsAsync();
Console.WriteLine($"Found {response2.Buckets.Count} buckets for test-runner profile");

try
{
    Environment.SetEnvironmentVariable("AWS_PROFILE", "non-existent");
    await s3Client.ListBucketsAsync();
}
catch (AmazonClientException)
{
    Console.WriteLine("Failed as expected locally since non-existent profile will cause the credential search to be short-circuited.");
}

Output:

Found 30 buckets for default profile
Found 16 buckets for test-runner profile
Failed as expected locally since non-existent profile will cause the credential search to be short-circuited.

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist

• My code follows the code style of this project
• I have read the README document
• I have added tests to cover my changes
• All new and existing tests passed

License

• I confirm that this pull request can be released under the Apache 2 license

[dscpinheiro]

Important: This change is intentional! The search order now matches the credentials-provider-chain-search-precedence SEP.

The order defined in the spec is: Environment variables: credentials -> Environment variables: web identity token / STS -> Profile: credentials.

[dscpinheiro]

This line was causing the test to fail locally for me. currentTime is already UTC after the DateTime changes that were recently merged into v4-development.