Per-bucket ephemeral keys

[amold1]

Summary:

Instead of a single long‑lived driver key shared across all buckets, we now create short‑lived, bucket‑scoped keys on demand to limit blast radius and align credentials with bucket lifecycle

Changes:

• Create bucket‑scoped keys on demand for policy/cleanup instead of a startup key.
• Adjust provisioner constructor and tests for the new per‑bucket flow.
• Add integration test for bucket‑scoped key isolation.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 50.60241% with 41 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.38%. Comparing base (f56b421) to head (6d405aa).
⚠️ Report is 5 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/servers/provisioner/provisioner.go	46.57%	32 Missing and 7 partials ⚠️
cmd/linode-cosi-driver/main.go	80.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #251      +/-   ##
==========================================
- Coverage   60.77%   60.38%   -0.40%     
==========================================
  Files          18       18              
  Lines         798      828      +30     
==========================================
+ Hits          485      500      +15     
- Misses        279      292      +13     
- Partials       34       36       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.