[codex] Add AWS RDS IAM auth token generator

[cmellard]

Summary

Adds a namespaced RDSIAMAuthToken generator for minting AWS RDS IAM auth tokens through External Secrets Operator.

The generator uses ESO's existing AWS generator session helper and the AWS SDK RDS auth token builder. It emits username, password, token, hostname, port, endpoint, and expires_at, with password and token carrying the same signed RDS IAM token so existing templates can map DATABASE_PASSWORD without bespoke migration logic.

API and wiring

• Adds generators.external-secrets.io/v1alpha1 RDSIAMAuthToken.
• Registers direct GeneratorRef usage and ClusterGenerator support.
• Adds CRD, bundle, Helm RBAC, snapshots, and generated API docs.
• Adds docs snippets with neutral AWS-shaped examples.

Validation

Local checks:

• git diff --check
• go test ./... from generators/v1/rdsiam
• go test ./generators/v1alpha1 ./externalsecrets/v1 ./externalsecrets/v1beta1 from apis
• go test ./esutils/resolvers from runtime
• go test ./pkg/register
• make test.crds
• make helm.test
• rg -n "shuttlerock|cmellard|6477|cjj5p7evnugo" docs/snippets/generator-rdsiam*.yaml docs/api/generator/rdsiam.md returned no matches

Live proof in the preview cluster:

• Deployed a namespace-scoped ESO controller in shuttlerock-cloud-cmellard-6477 using controller class rds-iam-project.
• Created a parallel RDSIAMAuthToken and ExternalSecret targeting a non-live test Secret.
• Forced refresh updated the Secret and produced the expected key shape.
• A one-shot psql pod using only the ESO-generated Secret connected successfully to RDS and returned the expected user, database, and schema.

Notes

This PR is for downstream review in the Shuttlerock fork only. It is not intended as the upstream contribution PR yet; upstream should likely get a design proposal first because this adds a new CRD.