chore: remove static AWS credentials

[glitchedmob]

Retires the long-lived SGF Devs VM credentials after replacing them with Kubernetes workload identity.

• Deletes the legacy IAM user, inline policy, and access key.
• Deletes the two SecureString parameters that stored the access key.
• Removes the obsolete infra-vm-workloads CI read grant.
• Preserves the K3s OIDC provider, workload boundary, and workload roles.

[glitchedmob]

Coordination: merge sgfdevs/infra-vm-workloads#7 before applying this PR. After the apply, remove the now-unused external-secrets-aws-creds Secrets from the external-secrets and openbao namespaces; no pods reference either Secret.