feat: wire use_interactive_session_role_for_api_calls to session management client

[tnightengale]

Summary

This PR completes the implementation of the existing use_interactive_session_role_for_api_calls credential flag for the interactive session management layer.

Background: AWS Glue Interactive Sessions security model

Glue Interactive Sessions uses a two-principal model (docs):

• Client principal — the IAM identity running dbt. Makes Glue API calls (CreateSession, RunStatement, etc.). Requires glue:* + iam:PassRole to the runtime role.
• Runtime role (role_arn) — passed to CreateSession. AWS Glue itself assumes this to execute Spark. Requires S3, CloudWatch, etc.

In cross-account scenarios (client principal in account A, Glue resources in account B), the client principal must first assume role_arn via STS before it can make any Glue API calls.

The bug

use_interactive_session_role_for_api_calls was already wired in impl.py::get_connection() to assume the role before making Glue management API calls (DDL, schema operations). However, GlueConnection.client — the boto3 client used for session lifecycle (CreateSession, GetSession, StopSession, DeleteSession) — never applied the same logic. This meant cross-account users would fail at session creation even with the flag enabled.

Changes

• dbt/adapters/glue/gluedbapi/connection.py: In the client property, add a branch that assumes role_arn via STS when use_interactive_session_role_for_api_calls=True, then uses the assumed credentials to create the Glue boto3 client for session management.
• tests/unit/gluedbapi/test_connection.py: Add test_client_assumes_role_when_flag_enabled to verify the STS assume-role path is taken and assumed credentials are passed to the Glue client.
• README.md: Document use_interactive_session_role_for_api_calls in the profiles config table (it was present in credentials.py but missing from docs).

Note on impl.py inconsistency

impl.py::get_connection() has a minor inconsistency vs. this implementation: it does not pass region_name to the STS client and uses RoleSessionName="dbt". This PR uses the more correct form (region_name forwarded, RoleSessionName="dbt-glue-session"). Aligning impl.py is left as a separate concern.

Test plan

• test_client_assumes_role_when_flag_enabled passes — verifies STS assume_role is called with correct RoleArn and RoleSessionName, and assumed credentials are forwarded to the Glue client
• test_client_uses_credentials_retry_settings still passes — verifies default (non-assume-role) path is unchanged
• Manual cross-account dbt run with use_interactive_session_role_for_api_calls: true in profiles.yml

🤖 Generated with Claude Code