test: verify Requester field is the assumed-role ARN
Add a bucket logging test that asserts the standard access log Requester
field is set to the assumed-role ARN (per AWS S3 spec) when a request is
made with STS temporary credentials.
The test creates an IAM role assumable by the alt user, assumes it via
STS, performs an S3 PutObject with the temporary credentials, flushes the
bucket log, and verifies the log record's Requester field matches
arn:aws:sts:::assumed-role/<role>/<session>.