fix(NODE-6051): only provide expected allowed keys to libmongocrypt after fetching aws kms credentials

[baileympearson]

Description

What is changing?

• AWS KMS credentials are now fetched using the same logic as AWS authentication (the AWSSDKTemporaryCredentialProvider).
• Only expected keys (sessionToken,accessKeyId, secretAccessKey) are returned to libmongocrypt after fetching kms credentials

I also fixed some unit test skipping logic on Node18+, which previously only skipped on Node 18 and 20. Now it skips on Node18+.

This PR includes changes from #4064 to get a greener CI.

Is there new documentation needed for these changes?

Nope.

What is the motivation for this change?

Release Highlight

AWS credentials with expirations no longer throw when using on-demand AWS KMS credentials

In addition to letting users provide KMS credentials manually, client-side encryption supports fetching AWS KMS credentials on-demand using the AWS SDK. However, AWS credential mechanisms that returned access keys with expiration timestamps caused the driver to throw an error.

The driver will no longer throw an error when receiving an expiration token from the AWS SDK.

Double check the following

• Ran npm run check:lint script
• Self-review completed using the steps outlined here
• PR title follows the correct format: type(NODE-xxxx)[!]: description
  • Example: feat(NODE-1234)!: rewriting everything in coffeescript
• Changes are covered by tests
• New TODOs have a related JIRA ticket

[W-A-James]

LGTM apart from skip reason change and update to highlight

[aditi-khare-mongoDB]

LGTM!