Fetch Docker secrets from AWS Secrets Manager

[mchatlas-hellosign]

Summary

• authenticate to AWS from the build jobs using branch-restricted GitHub OIDC
• load the shared Docker Hub username and token from AWS Secrets Manager
• allow pull-request builds to run without attempting Docker Hub login
• remove GitHub Actions secret references for Docker credentials

Verification

• git diff --check
• parsed .github/workflows/github-actions.yml with Ruby YAML aliases enabled
• bash -n on bin/php and every SDK run-build script
• GitHub Actions pull-request build

Based on the AWS secret-fetching pattern in hellosign/dropbox-sign-node#36.