fix: unify all CreateSecret paths under single mutex to prevent write-write conflict

[HaoXuAI]

Problem

Three code paths call CreateSecret on the same aws_secret concurrently:

1. CreateAWSInput — inline, no mutex, fired on EVERY S3 request
2. TryRefreshStorageSecret — no mutex, fired on table access
3. Multiple SIGV4Authorization instances sharing the same secret name

When two execute simultaneously → write-write conflict on alter with "aws_secret" → secret permanently poisoned → all queries fail until process restart.

Fix

• Replace inline refresh in CreateAWSInput with MaybeRefreshSecret (static mutex + 300s time gate)
• TryRefreshStorageSecret shares the same mutex via GetRefreshMutex()/GetLastRefreshTime() accessors
• Both paths update last_refresh_time on failure (backs off instead of cascading retries)

Reproduction

Any deployment using SIGV4 auth with web_identity credential chain under concurrent queries:

• ATTACH an Iceberg REST catalog with SIGV4 auth
• Run 2+ concurrent queries after 300s (credential refresh interval)
• Result: TransactionContext Error: Catalog write-write conflict on alter with "aws_secret"
• Secret permanently poisoned — all subsequent queries fail until process restart

Testing

Verified on production (Iceberg Insight Server, 2 replicas, ~10 concurrent queries):

• Before: 66% HTTP 500 rate under concurrency
• After: 0% errors over extended testing