fix(iam): derive every IAM ARN's partition from the region

[vieiralucas]

Summary

Found while fixing #2552. Users, roles, policies, instance profiles and MFA devices already build their ARN with the region's partition (aws-cn, aws-us-gov, aws-iso*), but several other IAM ARNs hardcoded arn:aws:, so in a China/GovCloud/ISO region they disagreed with the rest of the account.

Minted ARNs now use the region's partition:

• CreateGroup
• CreateOpenIDConnectProvider, CreateSAMLProvider
• UploadServerCertificate
• credential report root row
• policy-simulation root-principal fallback
• AssumeRoleWithWebIdentity fallback provider ARN

Renames keep the stored partition: UpdateGroup and UpdateServerCertificate rebuild the ARN from the entity's existing partition (falling back to the region), as UpdateUser already did. IAM is global, so a rename can arrive from any region; the three now share one existing_arn_partition helper.

ARN parsing accepts any partition:

• ChangePassword only resolved its caller from arn:aws:iam::, so an aws-cn/aws-us-gov user fell through to the anonymous no-op path and got a success without the old password being checked or the new one written.
• the pass-role trust check's role_name_from_arn and the evaluator's account-root classification (arn:<p>:iam::<acct>:root) likewise only matched aws.

No surface changes: no new API, flag, or SDK field; default-region (aws) output is unchanged, so conformance/docs/counts are unaffected.

Test plan

• New unit tests (fail on main):
  • entity_arns_carry_region_partition: group create/rename, OIDC, SAML, server cert upload/rename, credential report root row in cn-north-1 all emit arn:aws-cn:.
  • rename_from_other_region_keeps_partition: group + server cert created in cn-north-1, renamed from us-east-1, keep aws-cn.
  • change_password_resolves_non_aws_partition_principal: wrong old password rejected, right one accepted, for an aws-cn principal.
  • classify_aws_principal_recognizes_root_arn_in_any_partition, extended parses_role_name_from_arn.
• cargo test -p fakecloud-iam (556 pass), e2e iam + iam_enforcement pass, clippy clean.

---

Summary by cubic

Now that users, roles, policies, instance profiles, and MFA devices already derive their ARN partition from the region, this change makes the remaining IAM ARNs do the same so entities created in China, GovCloud, or ISO regions no longer disagree with the rest of the account.

• Groups, OIDC and SAML providers, server certificates, the credential report root row, the policy-simulation root fallback, and the web-identity fallback now mint arn:<partition>: instead of hardcoded arn:aws:.
• Renames of groups and server certificates keep the partition already stored on the entity, falling back to the region, matching how UpdateUser works.
• ChangePassword now resolves principals from any partition; before, aws-cn/aws-us-gov callers were treated as anonymous and got a success without the old password being checked.
• ARN parsing for pass-role trust checks and account-root classification in the policy evaluator now accepts any partition.

No new API, flag, or SDK field. Default-region output is unchanged.

^{Written for commit 804e332. Summary will update on new commits.}