Use default AWS creds chain to support EKS Pod Identity

[ryangoldblatt-bm]

Description

Use default AWS credentials chain to support EKS Pod Identity.

Currently the AWS authentication is hard-coded to support IRSA only by checking for injected env variables AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN.

These changes use the default AWS credentials chain which also supports EKS Pod Identity (which inject env variable AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE instead).

Pod Identity is a simpler approach in EKS than IRSA since OIDC identity providers are not needed, see here.

Which issue(s) does this PR resolve?

n/a

Type of change

• New feature (non-breaking change which adds functionality)

Testing and verification

Related unit test passes:

go test -v -run TestAwsEcrBasicAuthProvider ./pkg/common/oras/authprovider/aws/

=== RUN   TestAwsEcrBasicAuthProvider_Create
--- PASS: TestAwsEcrBasicAuthProvider_Create (0.00s)
=== RUN   TestAwsEcrBasicAuthProvider_Enabled
time="2025-10-14T14:43:29+01:00" level=error msg="basic ECR providerName was empty"
--- PASS: TestAwsEcrBasicAuthProvider_Enabled (0.00s)
=== RUN   TestAwsEcrBasicAuthProvider_ProvidesWithArtifact
--- PASS: TestAwsEcrBasicAuthProvider_ProvidesWithArtifact (0.00s)
=== RUN   TestAwsEcrBasicAuthProvider_ProvidesWithHost
--- PASS: TestAwsEcrBasicAuthProvider_ProvidesWithHost (0.00s)
=== RUN   TestAwsEcrBasicAuthProvider_GetAuthTokenWithoutRegion
--- PASS: TestAwsEcrBasicAuthProvider_GetAuthTokenWithoutRegion (0.00s)
PASS
ok  	github.com/ratify-project/ratify/pkg/common/oras/authprovider/aws	(cached)

We've also build and tested this patch in our environment which now enables Ratify to use EKS Pod Identity rather the IRSA to authenticate to our ECR repo.

Checklist

• Does the affected code have corresponding tests?
• Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
• Does this introduce breaking changes that would require an announcement or bumping the major version?
• Do all new files have appropriate license header?

Post merge requirements

• MAINTAINERS: manually trigger the "Publish Package" workflow after merging any PR that indicates Helm Chart Change