Freeze AWS credentials before SigV4 signing

[sylvesterkaczmarek]

Summary

Freeze the AWS credential set before constructing a SigV4 signer so each request is signed from one coherent credential generation.

get_auth_headers() currently passes the object returned by boto3.Session.get_credentials() directly to SigV4Auth. That object may be refreshable. Its access key, secret key, and session token are exposed through credential properties, so using the live refreshable object during signing can allow a refresh to occur while the signer is reading the credential set.

A request should be signed with one immutable access-key / secret-key / session-token tuple. Botocore's own signing path obtains a frozen credential snapshot before constructing the auth implementation.

Fix

Call credentials.get_frozen_credentials() after resolving the session credentials and pass that snapshot to SigV4Auth.

Static credentials are unaffected. Missing-credential behavior, region selection, request construction, and signed-header handling are unchanged.

Regression coverage

Adds a deterministic unit test verifying:

• get_frozen_credentials() is called exactly once;
• SigV4Auth receives the frozen snapshot rather than the live credential proxy;
• service and region arguments are preserved;
• the signed Authorization header is returned normally.

The production change is confined to the hand-maintained AWS SigV4 auth helper.