Improve AWS credential errors

[ghukill]

Purpose and background context

Why these changes are being introduced:

There are two main buckets (no pun intended) in which AWS credentials can fail:

1. They are not set or stale
2. They are pointing at the wrong environment

The error reporting for both is poor, with opaque DuckDB or boto3 errors.
For DuckDB it's during secret construction, and makes me mention of AWS.
For boto3, it's checking that destination bucket exists, which is better
but still confusing.

How this addresses that need:

• Catches AWS related errors in very different parts of the codebase,
  surfacing a normalized error message that something is wrong with AWS
  credentials.

How can a reviewer manually see the effects of these changes?

Previously, missing or stale credentials would throw an error like this:

...
_duckdb.Error: Secret Validation Failure: during `create` using the following:
Credential Chain: 'config'

And incorrect credentials (e.g. wrong environment) would look like this:

...
botocore.exceptions.ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden

With the changes, they both now look like this:

timdex_dataset_api.exceptions.AWSCredentialsError: AWS credentials absent or insufficient. Please ensure they are set and pointing at the right TIMDEX dataset environment.

See the new tests for come commentary / explanation of how to recreate (pointing at wrong environment and/or unsetting AWS credentials completely).

Includes new or updated dependencies?

NO

Changes expectations for external applications?

NO

What are the relevant tickets?

• None

Code review

• Code review best practices are documented here and you are encouraged to have a constructive dialogue with your reviewers about their preferences and expectations.

[ehanson8]

Smart update!