feat(identity): Add X-Amz-Bedrock-AgentCore-Identity-WAT header propa…

[Sudip2403]

…gation

Add support for workload identity chain propagation across service hops:

• Add IDENTITY_WAT_HEADER constant and allowlist it in is_forwardable_header
• Add identity_wat context variable to BedrockAgentCoreContext
• Extract the WAT header from inbound requests in _build_request_context
• Auto-propagate on outbound Runtime/Gateway boto3 calls via event handler
• Add @requires_wat decorator for explicit WAT minting and propagation
• Register WAT propagation on Runtime data plane client only (Identity is excluded as it is the WAT issuer)
• Document manual Gateway MCP call propagation pattern
• Add comprehensive tests for all new functionality

Issue #, if available:

Description of changes:

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[jariy17]

Thanks for the PR. We already store the workload access token in the context. Can we use that instead?

[jariy17]

Instead of filtering on Line 52, we should call this register for every WAT allowlisted operation (InvokeAgentRuntime).

for op in ("InvokeAgentRuntime", ...):
      self.dp_client.meta.events.register(
          f"before-sign.bedrock-agentcore.{op}",
          _add_identity_wat_header,
          unique_id=f"identity-wat-{op}",
      )

[jariy17]

Please scope this client's type to botocore.client.BaseClient.

[jariy17]

We are already store WAT in _workload_access_token. Can this PR just use this variable instead of creating a whole new one?