### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### The Feature

Add `aws` to the OIDC identity providers in `get_secret` (`litellm/secret_managers/main.py`), so `oidc/aws/<audience>` mints a signed JWT via `sts:GetWebIdentityToken`:

```yaml litellm_params: model: azure/gpt-5.5 api_base: https://my-resource.openai.azure.com/ api_version: "v1" azure_ad_token: "oidc/aws/api://AzureADTokenExchange" ```

AWS shipped IAM Outbound Identity Federation at re:Invent 2025, every account now has a public OIDC issuer, and `GetWebIdentityToken` signs a JWT with the IAM role. Any OIDC-compliant IdP can verify it.

Implementation is one `elif` branch mirroring the existing `google` one. No new dependency (boto3 is already there for Bedrock), lazy-imported for `check-import-safety`, reusing `oidc_cache`.

### Motivation, pitch

LiteLLM on EC2 talking to Azure OpenAI still needs a static key or client secret, every other host already has a keyless path. EC2 was the exception only because it had no OIDC issuer, AWS fixed it, now LiteLLM just needs to call the API.

**Verified working** today via a runtime monkeypatch of…