fix(aws-credentials): default the OIDC audience to sts.amazonaws.com

[domengabrovsek]

Summary

• Every OIDC role assumption through the aws-credentials wrapper fails with Could not assume role with OIDC: The web identity token provided could not be validated.
• Root cause: aws-actions/configure-aws-credentials declares audience with default: sts.amazonaws.com, but a GitHub Actions input default applies only when the input is absent, never when it is present and empty. Forwarding ${{ inputs.audience }} with a local default of '' passed an explicit empty string and clobbered that default, so GitHub minted the token with aud=https://github.com/<owner> and STS rejected it.
• Sets the local default to sts.amazonaws.com, and coalesces at the call site so a caller forwarding its own empty-defaulted input cannot reintroduce it.
• Updates the input table in docs/actions/aws-credentials.md.

Why the other empty passthroughs are left alone

role-session-name and role-duration-seconds look like the same bug but aren't: the wrapped action declares no action.yml default for either, so their empty strings fall through to its internal defaults (GitHubActions, one hour). Pinning values here would change behavior rather than restore it. Only audience has a declared default to clobber.

Blast radius

.github/workflows/cloudflare-pages-deploy.yml is the only consumer in this repo and it doesn't pass audience, so the declared default alone is sufficient. Any repo calling the composite directly for OIDC was hitting this.

Verification

• action.yml and the docs parse cleanly
• Real proof is a green OIDC deploy in a consumer repo. domengabrovsek/gabrovsek-dev run 31489563658 failed on exactly this: setup-node-npm and the build passed, Configure AWS credentials failed. Re-running it after this merges is the check that matters.