feat(credentials): surface External ID and trust policy after add [COMP-1405]

[munishchouhan]

Description

Closes COMP-1884

Brings CLI output to parity with the web UI modal for AWS role-mode credentials. After tw credentials add aws --mode role --generate-external-id … succeeds, the CLI now follows up with GET /credentials/{id} and prints:

• the External ID generated by Platform (so users don't have to do a separate fetch)
• the trust policy snippet rendered server-side when the installation is configured with TOWER_AWS_JUMP_ROLE_ARN + TOWER_AWS_JUMP_EXTERNAL_ID (so users can paste it directly into their IAM role's trust relationship)

The follow-up describe is best-effort: if it fails, the credential is still created and the CLI returns the same minimal output as before. Both fields are nullable — for providers/flows that don't have either, the output is unchanged.

Sample output (AWS role mode with jump role configured)

$ tw credentials add aws --mode role --generate-external-id \
    --assume-role-arn arn:aws:iam::222:role/CustomerRole \
    -n my-aws-creds

  New AWS credentials 'my-aws-creds (abc123)' added at user workspace.

  External ID: a1b2c3d4-e5f6-...

  Trust policy (paste this into your IAM role's trust relationship):

    {
      "Version": "2012-10-17",
      ...
    }

Versioning

• towerJavaSdkVersion: 1.150.0 → 1.167.0 (consume the new setupSnippet field on DescribeCredentialsResponse).
• VERSION-API: 1.148.0 → 1.167.0 (matches the minimum API version where the dependent field was introduced).
• service-info.json test fixture bumped to match.
• conf/reflect-config.json regenerated via ./gradlew runReflectionConfigGenerator -Dtracing-agent=true on GraalVM CE 21 to register the new SDK model getters/setters (e.g. AwsCloudConfig.getDeletedResources) for the native binary. Without this the JVM tests passed but the binary tests failed with tried to reflectively invoke method … without it being registered for runtime reflection.

Dependency chain

This PR is the third in a chain landing the setupSnippet feature end-to-end:

1. Platform (seqeralabs/platform PR #11417) — adds the setupSnippet field to DescribeCredentialsResponse and the AwsTrustPolicyRenderer that populates it. Merged + deployed.
2. tower-sdk-gencode update-1.167.0 — regenerates the SDK from the updated OpenAPI spec. Published as tower-java-sdk 1.167.0.
3. This PR — consumes the new SDK + adds the CLI UX.

Guidelines for testing

1. Install this build locally (./gradlew installDist) or use the published artifact once available.
2. Point at a Platform instance configured with both TOWER_AWS_JUMP_ROLE_ARN and TOWER_AWS_JUMP_EXTERNAL_ID (e.g. local dev with those env vars set).
3. Create an AWS role-mode credential:

   tw credentials add aws --mode role --generate-external-id \
     --assume-role-arn arn:aws:iam::222:role/CustomerRole \
     -n my-aws-creds
   

   Expected: success message includes the generated External ID and the trust policy block.
4. Negative paths:
   • On a Platform without the jump-role env vars: the External ID still appears, but no trust policy block.
   • On a non-AWS credential (e.g. tw credentials add google …): neither line appears.
   • Simulate the follow-up describe failing (e.g. revoke the token immediately after create) — the original success message still prints; nothing crashes.

Checklist

• Create or update unit tests.
• Create or update E2E tests.
• Update the README / documentation.
• Run @claude release-notes to generate release notes for EDU team
• Document any new environment variables

(No new env vars introduced — TOWER_AWS_JUMP_ROLE_ARN / TOWER_AWS_JUMP_EXTERNAL_ID are already documented platform-side from COMP-1426.)

[munishchouhan]

tested locally with stage

tower-cli % ./build/native/nativeCompile/tw --url https://cloud.stage-seqera.io/api credentials add aws \
    --mode role \
    --generate-external-id \
    --assume-role-arn arn:aws:iam::222222222222:role/CustomerRole \
    -n test-trust-policy

  New AWS credentials 'test-trust-policy (12121212121)' added at user workspace

  External ID: agagagsgsgsgsj

  Trust policy (paste this into your IAM role's trust relationship):

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::898507537698:role/SeqeraPlatformCloudAccessRoleStage"
          },
          "Action": "sts:AssumeRole",
          "Condition": {
            "StringEquals": {
              "sts:ExternalId": "agagagsgsgsgsj"
            }
          }
        },
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::898507537698:role/SeqeraPlatformCloudAccessRoleStage"
          },
          "Action": "sts:TagSession"
        }
      ]
    }