fix: role last-used tracking, and record S3 requests in last-used metadata

Role last-used tracking was missing entirely - `GetRole` returned a `RoleLastUsed` element that nothing ever wrote, rendering the zero time instead of the empty element AWS returns for an unused role - and access key last-used only ever saw the `IAM`/`STS` control plane, so a credential used exclusively against the S3 gateway reported as never used. Roles now record a use whenever a request authenticates with one of their session credentials, through a new `Storer.RecordRoleUsage` mirroring `RecordAccessKeyUsage`, gated on the session's role still being the one it was minted against so a session outliving its role can't attribute its use to a same-named replacement. `LastUsedDate` became a `*time.Time` so an unused role renders as an empty element.

Both records now cover the S3 data plane as well: the gateway sends its configured region and `s3` on evaluate-policy and the IAM service records the caller there, so `GetAccessKeyLastUsed's` `ServiceName` is now iam, sts or s3. That call was chosen over derive-signing-key, which runs before signature verification and takes its region and service from the caller's own `Authorization` header - recording there would let anyone who knows an access key id refresh and poison another identity's audit record. Requests denied by a bucket policy or made against a public bucket are not recorded, since neither reaches identity-policy evaluation. To keep per-request recording affordable, an update is skipped while the stored record has the same service and region and is under a minute old; a change of either is written through immediately.

Assuming a role is not a use, a request denied by an identity policy is, and both successful and denied S3 requests update the record. Also moves the `OIDC-dependent` tests into the `s3-iam-session` group so runoidctests.sh runs a single group.

iamapi/storage/common.go

@@ -278,6 +278,47 @@ func paginateTags(tags []types.Tag, marker string, maxItems int32, keyCase iamut
 	return out
 }
 
+// UsageRecordCoalesceWindow is how long a last-used record is left alone
+// after a write that already reported the same service and region. Every
+// authenticated S3 data-plane request records a use, so without this the
+// internal storer would rewrite the whole IAM file (twice — it keeps a
+// backup) on every GET, and the Vault storer would issue a read-modify-write
+// per request. Real IAM's own last-used data is coarse for the same reason,
+// so nothing observable is lost.
+//
+// A change of service or region is never coalesced: that is the part of the
+// record an operator reads to answer "what is this credential being used
+// for", and it must be able to change the moment the answer does.
+const UsageRecordCoalesceWindow = time.Minute
+
+// shouldRecordUsage reports whether a last-used update is worth the write.
+// prev/prevService/prevRegion describe what is already stored — a zero prev
+// meaning nothing is — and service/region/when the use being recorded. Roles
+// have no service dimension and pass "" for both service arguments.
+func shouldRecordUsage(prev time.Time, prevService, prevRegion, service, region string, when time.Time) bool {
+	if prev.IsZero() || prevService != service || prevRegion != region {
+		return true
+	}
+	// A clock that moved backwards (or a racing writer that already stored a
+	// later use) leaves prev in the future: keep the newer record rather
+	// than replacing it with this older one.
+	return when.Sub(prev) >= UsageRecordCoalesceWindow
+}
+
+// roleLastUsedRecord unpacks role's stored last-used values for
+// shouldRecordUsage, reading a missing element or a missing date as never
+// used.
+func roleLastUsedRecord(role types.Role) (time.Time, string) {
+	if role.RoleLastUsed == nil {
+		return time.Time{}, ""
+	}
+	var when time.Time
+	if role.RoleLastUsed.LastUsedDate != nil {
+		when = *role.RoleLastUsed.LastUsedDate
+	}
+	return when, role.RoleLastUsed.Region
+}
+
 func unwrapAPIError(err error) error {
 	var apiErr iamerr.APIError
 	if errors.As(err, &apiErr) {