After CSHARP-5696, `AWSFallbackCredentialsSource` resolves credentials via the static `DefaultAWSCredentialsIdentityResolver.GetCredentials/GetCredentialsAsync`, which ignore the caller's CancellationToken (the SDK applies its own 35s timeout). We could instead use the instance methods ResolveIdentity(IClientConfig, CancellationToken) / ResolveIdentityAsync(...), holding a single long-lived resolver instance.