s3: fix STS call per request by caching AssumeRole credentials

The stscreds.AssumeRoleProvider from AWS SDK Go v2 does not cache
credentials by itself. The SDK only auto-wraps providers with
aws.CredentialsCache when they are loaded via
config.LoadDefaultConfig; when assigned directly to
aws.Config.Credentials it must be wrapped manually, as documented on
stscreds.NewAssumeRoleProvider.

Without the cache, configurations using role_arn would call AssumeRole
once per S3 request, flooding STS and CloudTrail.

See: https://forum.rclone.org/t/aws-iam-roles-credentials-arent-cached/53732

backend/s3/s3.go

@@ -1522,8 +1522,10 @@ func s3Connection(ctx context.Context, opt *Options, client *http.Client) (s3Cli
 			}
 		}
 
-		// Create AssumeRole credentials provider
-		awsConfig.Credentials = stscreds.NewAssumeRoleProvider(stsClient, opt.RoleARN, assumeRoleOptions)
+		// Create AssumeRole credentials provider, wrapped in a
+		// CredentialsCache so we don't call AssumeRole on every
+		// request.
+		awsConfig.Credentials = aws.NewCredentialsCache(stscreds.NewAssumeRoleProvider(stsClient, opt.RoleARN, assumeRoleOptions))
 	}
 
 	provider = loadProvider(opt.Provider)