Support GOBUILDCACHE_-prefixed AWS env vars to prevent env leakage

[cchristous]

Summary

When gobuildcache is used as GOCACHEPROG, standard AWS env vars (AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) set in the shell are inherited by all child processes, including test binaries spawned by go test. This causes issues when test code reads these vars and gets unexpected values — for example, SRG component tests seeing AWS_REGION=us-west-2 from the build cache config rather than their expected value.

This PR adds support for GOBUILDCACHE_-prefixed AWS env vars, using the existing getEnvWithPrefix convention already established for all other gobuildcache configuration. Users can now set only the prefixed vars (e.g., GOBUILDCACHE_AWS_REGION), keeping standard AWS_* vars out of the environment entirely so other processes are unaffected.

Changes

• pkg/backends/s3.go: NewS3 now accepts an S3Config struct with region, access key, secret key, and session token. The backend no longer reads env vars directly — that responsibility stays in main.go with all other config resolution.
• main.go: Added resolveS3Config() using the existing getEnvWithPrefix helper. Includes validation that errors if only one of access key / secret key is set (catches misconfiguration instead of silently falling back to the default credential chain).
• env_test.go: Added TestResolveS3Config with 6 test cases covering prefix precedence, unprefixed fallback, partial credential errors, and optional session token.
• README.md: Updated S3 usage example and config table to document the new prefixed AWS vars including GOBUILDCACHE_AWS_SESSION_TOKEN.

Why this is safe

• Fully backward-compatible: unprefixed AWS_* vars still work as fallbacks when GOBUILDCACHE_* vars aren't set.
• The getEnvWithPrefix convention is already established and well-tested for all other gobuildcache config vars — this just extends it to AWS vars.
• Partial credential misconfiguration (e.g., access key set but secret key missing) now returns a clear error instead of silently using a different credential source.
• Session token support (GOBUILDCACHE_AWS_SESSION_TOKEN) enables users with temporary credentials (STS AssumeRole, SSO) to use the prefixed env var flow.

Test plan

• TestResolveS3Config covers: empty config, prefix precedence, unprefixed fallback, partial credential errors (both directions), optional session token
• All existing unit tests pass
• Build passes
• Integration tests (require live S3/GCS credentials, verified manually or in CI)