aws: IRSA watched directory fix (#41873)

Commit Message: aws: IRSA watched directory fix
Additional Description: Bugfix to add a watched directory for web
identity tokens to ensure that filesystem replacement will trigger the
new token to be used. Thanks to all on
envoyproxy/envoy#41047 for the heads up on
this bug.
Risk Level: Low
Testing: Unit
Docs Changes: Yes - API docs and extension docs
Release Notes: Yes - minor change
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue] envoyproxy/envoy#41047
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional [API
Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):]

---------

Signed-off-by: Nigel Brittain <nbaws@amazon.com>
Signed-off-by: Nigel Brittain <108375408+nbaws@users.noreply.github.com>

Mirrored from https://github.com/envoyproxy/envoy @ 08698de7baad3e87111a7e7bddb841259244aaa9

Author: update-envoy[bot]

envoy/extensions/common/aws/v3/credential_provider.proto

@@ -77,8 +77,10 @@ message InlineCredentialProvider {
 // to retrieve AWS credentials.
 message AssumeRoleWithWebIdentityCredentialProvider {
   // Data source for a web identity token that is provided by the identity provider to assume the role.
-  // When using this data source, even if a ``watched_directory`` is provided, the token file will only be re-read when the credentials
-  // returned from AssumeRoleWithWebIdentity expire.
+  // If a ``watched_directory`` is not provided, one will be automatically inferred from the directory of the token file. This is to ensure
+  // that if the token file is rotated, the new token will be picked up. This behaviour differs from the standard envoy data source behavior, which does not
+  // automatically watch the directory of a file data source.
+  // Even when file rotation occurs, current credentials will continue to be used until they expire, at which point new credentials will be retrieved using the new token.
   config.core.v3.DataSource web_identity_token_data_source = 1
       [(udpa.annotations.sensitive) = true];