fix(bedrock): exclude connection header from SigV4 signing

[lazerg]

• I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

BedrockAwsAuth.sign passes the hop-by-hop Connection header to the SigV4 signer. Proxies like Bedrock Mantle rewrite or drop that header on the way through, so Bedrock rebuilds a different canonical request and rejects valid AWS credentials with a 401 signature mismatch. This drops connection before signing, the same way botocore leaves hop-by-hop headers out of the signature.

src/openai/lib/ is hand-written and the generator does not touch it, per CONTRIBUTING.md.

Additional context & links

Fixes #3563

[jbeckwith-oai]

[P2] Cover the complete volatile-header set supported by this dependency range

The new _HOP_BY_HOP_HEADERS tuple contains only connection, but the Bedrock extra still supports botocore>=1.40.0. Older supported botocore releases do not exclude keep-alive, proxy-authenticate, proxy-authorization, te, trailer, or upgrade. With botocore 1.40.61 at this head, a request containing those fields produced SignedHeaders=content-type;host;keep-alive;proxy-authenticate;proxy-authorization;te;trailer;upgrade;..., so an intermediary rewriting any of them causes the same 401 signature mismatch this PR is meant to fix. Connection can also nominate additional hop-by-hop field names that intermediaries must remove.

AWS explicitly says not to sign the full volatile transport-header set: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html. Botocore addressed the same gap comprehensively in boto/botocore#3643. Please either exclude the complete set (including case variants and Connection-nominated fields) or raise the botocore floor to a release containing that upstream fix, and parameterize the regression test across the set.

Also, the current implementation removes Connection from the outgoing request entirely because the caller later replaces its headers with auth.sign() output. The stated requirement is to exclude it from SignedHeaders; botocore preserves volatile headers while leaving them unsigned. Please preserve an explicit caller Connection: close unless dropping that transport instruction is intentional and covered as an API change.

The targeted conformance suite passes 21/21, both sync and async paths exclude mixed-case Connection in an end-to-end mock transport check, and Ruff, formatting, Pyright, and diff checks are clean. GitHub reports no CI checks for this branch.