[Refactor][Kiro] Migrate the kiro plugin from aws-sdk-go v1 to aws-sdk-go-v2 #9195

What and why to refactor

backend/plugins/kiro is the only consumer of github.com/aws/aws-sdk-go
(v1). The AWS SDK for Go v1 reached
end-of-support on 2025-07-31;
it no longer receives bug or security fixes. Its final release, v1.55.8, marks
every package as deprecated, so staticcheck reports SA1019 for each import:

plugins/kiro/api/test_connection.go:24-25   aws, service/s3
plugins/kiro/tasks/identity_client.go:21-24 aws, aws/credentials, aws/session, service/identitystore
plugins/kiro/tasks/s3_client.go:25-28       aws, aws/credentials, aws/session, service/s3
plugins/kiro/tasks/s3_file_collector.go:24-25 aws, service/s3

This is what turned the lint job red on the Dependabot group #9192. It is
tolerated for now by a narrowly scoped lint exclusion (see the linked PR), but
that only hides the debt.

Describe the solution you'd like

Move the plugin to aws-sdk-go-v2:

• aws/session + aws/credentials → config.LoadDefaultConfig(ctx, config.WithRegion(…), config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(…)))
• service/s3 → github.com/aws/aws-sdk-go-v2/service/s3 (ListObjectsV2,
  GetObject, …; request/response types move to s3/types, calls take a
  context.Context)
• service/identitystore → github.com/aws/aws-sdk-go-v2/service/identitystore
• adapt the test doubles in tasks/s3_client_test.go,
  tasks/s3_file_collector_test.go and tasks/discovery_test.go to the v2
  client interfaces
• afterwards: drop github.com/aws/aws-sdk-go from backend/go.mod and remove
  the temporary exclusion from backend/.golangci.yaml

The new modules are Apache-2.0 licensed. Dependabot's existing
go-minor-patch group (patterns: ["*"]) already bundles the many v2
sub-modules, so no extra configuration is needed.

@warren830 — you authored the kiro plugin (#9073, #9076, #9082). Would you be
willing to take this on, or review a migration PR? The plugin talks to real
S3 buckets and IAM Identity Center, which I can't test without a Kiro/AWS
setup, so a run against a real environment by someone who has one would be
essential.

Related issues

• build(deps): bump the go-minor-patch group in /backend with 26 updates #9192 (Dependabot go-minor-patch group, red because of SA1019)
• PR with the temporary lint exclusion: fix(ci): make Dependabot gomod PRs tested and lint-clean #9197
• Tracking issue for removing aws-sdk-go v1 from the build: [Refactor][Build] Remove the end-of-support aws-sdk-go v1 from backend/go.mod #9196

Additional context

The plugin's unit tests (api, impl, models, tasks) pass with
v1.55.8 from #9192, so this is not urgent breakage — it is about not staying
on an unsupported SDK.