fix(amazon-bedrock-mantle): refresh IAM bearer token via resolveConfigApiKey cache lookup (#68903) * fix(amazon-bedrock-mantle): refresh IAM bearer token via resolveConfigApiKey cache lookup The Mantle plugin generates a bearer token from IAM credentials at discovery time and bakes it as a static string into the provider config. After the token's cache TTL expires (~1hr), requests fail because resolveConfigApiKey only handled the explicit AWS_BEARER_TOKEN_BEDROCK env var case. Fix: expose getCachedIamToken() as a sync read from the existing iamTokenCache, and wire it into resolveConfigApiKey as a fallback when no explicit env var is set. The catalog.run still generates/refreshes the token on discovery; this change ensures the cached token is served at auth resolution time. Fixes #68900 * fix(amazon-bedrock-mantle): refresh runtime IAM bearer auth * docs(changelog): note Mantle IAM refresh * fix(agents): apply runtime auth in simple completion --------- Co-authored-by: Vincent Koc <vincentkoc@ieee.org>