feat(aliyun): add STS AssumeRole granter

[tonghuaroot]

Resolves #847. Part of #807.

Adds AssumeRoleGrant and AssumeRoleGranter for Alibaba Cloud RAM STS AssumeRole, implementing GrantCredential in the same shape as the AWS granter (#813). The source credential supplied by Granter signs the STS request directly; the returned credential carries exact Expiration and is never cached. expires_in maps to DurationSeconds (900..=43200), and an optional inline session Policy is supported.

The STS request build, HMAC-SHA1 signing, and response parsing are extracted into a shared assume_role module that both the granter and the existing AssumeRoleCredentialProvider reuse. The provider keeps its public API and ProvideCredential is unchanged.

Testing

• cargo fmt, cargo clippy --all-targets --all-features -- -D warnings, and cargo test all pass.
• Deterministic tests over a mock HttpSend: golden signature over the exact signed parameter set, parameter assertions, and the source-validation, duration-range, and post-I/O expiry error paths. The existing provider signature test still passes, confirming the extracted signing is byte-identical.
• Validated end to end against real Alibaba Cloud STS: a base RAM user credential assumes a role and receives a valid temporary credential.

Real-service CI coverage needs Actions secrets and is tracked in #825; happy to follow up on that wiring.

This change was written with AI assistance; I have reviewed and understand it.