fix: honor configured STS endpoint for "ambient" credentials

Ambient credential resolution built a bare STS client, so a web-identity
token found by the SDK default chain (e.g. AWS_WEB_IDENTITY_TOKEN_FILE on
a self-hosted runner) was exchanged with public STS instead of any
operator-configured sts-endpoint. Resolution now passes the configured
region, endpoint, and proxy handler to the default provider chain.

package-lock.json

@@ -11,6 +11,7 @@
       "dependencies": {
         "@actions/core": "^3.0.1",
         "@aws-sdk/client-sts": "^3.1116.0",
+        "@aws-sdk/credential-provider-node": "^3.972.63",
         "@smithy/node-http-handler": "^4.11.3",
         "proxy-agent": "^8.0.2"
       },