[Python] Add examples for AWS credentials from a secret manager

[shunping]

Add examples under apache_beam/examples/secret_manager that set --aws_credentials_secret_manager to read AWS credentials from Google Cloud Secret Manager:

• aws_credentials_s3_read.py: reads an S3 file outside a pipeline.
• aws_credentials_s3_pipeline.py: reads an S3 file in a pipeline (DirectRunner or Dataflow).
• aws_credentials_secret_read.py: reads a secret from AWS Secrets Manager with Secret.parse_secret_option and Secret.from_json.

Part of #40528.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.93%. Comparing base (76f6e6d) to head (16a8777).
⚠️ Report is 211 commits behind head on master.

Additional details and impacted files

@@              Coverage Diff              @@
##             master   #40592       +/-   ##
=============================================
+ Coverage     56.16%   79.93%   +23.76%     
=============================================
  Files          1124      488      -636     
  Lines        178336    82557    -95779     
  Branches       1489        0     -1489     
=============================================
- Hits         100170    65991    -34179     
+ Misses        75645    16566    -59079     
+ Partials       2521        0     -2521     

Flag	Coverage Δ
go	?
java	?
python	79.93% <ø> (+0.37%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

📋 Review Summary

This PR adds three clear and well-documented examples demonstrating how to configure --aws_credentials_secret_manager to resolve AWS credentials from Google Cloud Secret Manager when reading from S3 or AWS Secrets Manager. The examples are concise, follow Apache Beam conventions, and include helpful IAM permission documentation.

🔍 General Feedback

• In aws_credentials_secret_read.py, printing the retrieved secret directly triggers CodeQL py/clear-text-logging-sensitive-data alerts (causing the CodeQL check to fail) and models an anti-pattern if copied into production code. Logging or printing non-sensitive metadata (such as secret length) instead of the raw secret value would resolve the security check while still verifying secret retrieval.
• Using json.dumps({'name': known_args.secret_id}) in aws_credentials_secret_read.py is safer than manual f-string interpolation when constructing the JSON secret specification.

---

💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.

[github-actions]

Assigning reviewers:

R: @jrmccluskey for label python.
Backup reviewer: damccorm (if the main reviewer is unresponsive, you can escalate to them by tagging their username)

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).

[jrmccluskey]

LGTM, one nit

[jrmccluskey]

Small nit, I would suggest providing a requirements.txt file to run the examples here. Not necessary as long as everything is documented, just a consideration

[shunping]

Thanks! Added the requirements file.