fix: role last-used tracking, and record S3 requests in last-used metadata

Role last-used tracking was missing entirely - `GetRole` returned a `RoleLastUsed` element that nothing ever wrote, rendering the zero time instead of the empty element AWS returns for an unused role - and access key last-used only ever saw the `IAM`/`STS` control plane, so a credential used exclusively against the S3 gateway reported as never used. Roles now record a use whenever a request authenticates with one of their session credentials, through a new `Storer.RecordRoleUsage` mirroring `RecordAccessKeyUsage`, gated on the session's role still being the one it was minted against so a session outliving its role can't attribute its use to a same-named replacement. `LastUsedDate` became a `*time.Time` so an unused role renders as an empty element.

Both records now cover the S3 data plane as well: the gateway sends its configured region and `s3` on evaluate-policy and the IAM service records the caller there, so `GetAccessKeyLastUsed's` `ServiceName` is now iam, sts or s3. That call was chosen over derive-signing-key, which runs before signature verification and takes its region and service from the caller's own `Authorization` header - recording there would let anyone who knows an access key id refresh and poison another identity's audit record. Requests denied by a bucket policy or made against a public bucket are not recorded, since neither reaches identity-policy evaluation. To keep per-request recording affordable, an update is skipped while the stored record has the same service and region and is under a minute old; a change of either is written through immediately.

Assuming a role is not a use, a request denied by an identity policy is, and both successful and denied S3 requests update the record. Also moves the `OIDC-dependent` tests into the `s3-iam-session` group so runoidctests.sh runs a single group.

iamapi/internal/iammiddleware/auth.go

@@ -122,6 +122,16 @@ func VerifyIAMAuth(service string, root *RootCredentials, store iamutil.Identity
 				debuglogger.Logf("failed to record access key last-used metadata for %q: %v", authData.Access, err)
 			}
 		}
+		// The same, for the role a session credential authenticated as: this
+		// is what GetRole reports as RoleLastUsed. identity.Role is set only
+		// when the session's role still exists *and* is still the same role
+		// the session was minted against, so a session outliving its role
+		// records nothing rather than attributing its use to a same-named replacement.
+		if identity.Role != nil {
+			if err := store.RecordRoleUsage(ctx.Context(), identity.Role.RoleName, SigningRegion, time.Now().UTC()); err != nil {
+				debuglogger.Logf("failed to record role last-used metadata for %q: %v", identity.Role.RoleName, err)
+			}
+		}
 		return nil
 	}
 }

iamapi/internal/iamutil/identity.go

@@ -46,6 +46,7 @@ type IdentityStore interface {
 	GetUser(ctx context.Context, username string) (*types.User, error)
 	GetOIDCProvider(ctx context.Context, arn string) (*types.OIDCProvider, error)
 	RecordAccessKeyUsage(ctx context.Context, accessKeyID, service, region string, when time.Time) error
+	RecordRoleUsage(ctx context.Context, roleName, region string, when time.Time) error
 }
 
 // ResolveSessionByToken resolves a temporary (ASIA…) access key to the