feat: add identity client passthrough and tests

[nborges-aws]

Description of changes:

• Add __getattr__ passthrough with accept_snake_case_kwargs to IdentityClient
• Control plane allowlisted methods (11):
  • OAuth2 credential provider CRUD: create_oauth2_credential_provider, get_oauth2_credential_provider, list_oauth2_credential_providers, update_oauth2_credential_provider, delete_oauth2_credential_provider
  • API key credential provider CRUD: create_api_key_credential_provider, get_api_key_credential_provider, list_api_key_credential_providers, delete_api_key_credential_provider
  • Workload identity: get_workload_identity, update_workload_identity
• Data plane allowlisted methods (5):
  • get_resource_oauth2_token, get_resource_api_key, get_workload_access_token, get_workload_access_token_for_jwt, get_workload_access_token_for_user_id
• Remove 4 explicit methods with no additional logic, now covered by passthrough: create_oauth2_credential_provider, create_api_key_credential_provider, update_workload_identity, get_workload_identity
• Retain explicit methods that have additional logic: get_workload_access_token, create_workload_identity, complete_resource_token_auth, get_token, get_api_key

Note: create_oauth2_credential_provider_and_wait and delete_oauth2_credential_provider_and_wait were originally part of this change, but were removed. Though the service model defines a status field on the GetOauth2CredentialProvider response, integ tests revealed that the API was not returning any status field. The provider became available synchronously after creation. Polling methods were timing out waiting for a status that never appears, even when provider was created successfully. Thus the *_and_wait methods were dead code.

Test plan:

• Unit tests (24 total):
  • Existing tests updated to use getattr passthrough calling convention (kwargs instead of positional dict)
  • OAuth2/API key creation, workload identity CRUD, token flows, auth completion, token polling
• Integration tests (9 total):
  • Passthrough: list OAuth2 providers, list API key providers, list with snake_case kwargs
  • Error handling: get nonexistent OAuth2 provider, get nonexistent API key provider
  • OAuth2 CRUD lifecycle: create → get → delete

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[github-actions]

⚠️ Breaking Change Warning

Found 4 potential breaking change(s) in this PR:

�[1msrc/bedrock_agentcore/services/identity.py�[0m:0: IdentityClient.create_oauth2_credential_provider: �[33mPublic object was removed�[39m
�[1msrc/bedrock_agentcore/services/identity.py�[0m:0: IdentityClient.create_api_key_credential_provider: �[33mPublic object was removed�[39m
�[1msrc/bedrock_agentcore/services/identity.py�[0m:0: IdentityClient.update_workload_identity: �[33mPublic object was removed�[39m
�[1msrc/bedrock_agentcore/services/identity.py�[0m:0: IdentityClient.get_workload_identity: �[33mPublic object was removed�[39m

---

Note: This is an automated static analysis check. Some flagged changes may be intentional.
Please confirm each item is expected and, if so, add a migration note to CHANGELOG.md.