The documented IcebergRESTVendedS3Provider never refreshes against a REST catalog #7388

Describe the bug

s3-credential-providers.md points users at IcebergRESTVendedS3Provider (a copy lives under spark/src/test) as the reference for REST-vended credentials. It builds VendedCredentialsProvider.create(catalogProperties), which reads credentials.uri. REST catalogs don't send that key. They return client.refresh-credentials-endpoint, often relative to uri, and Iceberg's AwsClientProperties resolves it into credentials.uri before building VendedCredentialsProvider.

A copy of the reference therefore never refreshes, and the native scan fails with ExpiredToken once the vended credentials expire. Its test sets credentials.uri by hand and covers only the static path.

Expected behavior

The documented approach refreshes against a real REST catalog.

Additional context

#7363 removes the reference class and points the docs at a provider that goes through AwsClientProperties.