fix(query): enable role-based S3 credential chain

[everpcpc]

I hereby agree to the terms of the CLA available at: https://docs.databend.com/dev/policies/cla/

Summary

Problem

All other S3 entry points (config-driven tables, COPY, stages with role_arn) already re-enabled the credential chain automatically, but CREATE TABLE … CONNECTION_NAME persisted allow_credential_chain=None, so AssumeRole silently broke on read/write.

Solution

The operator now applies the same role-aware default for every S3 config, and the binder/stage glue only overrides when they truly need to. With this change, the connection-backed CREATE TABLE path finally matches the behavior of the other code paths.

Tests

• Unit Test
• Logic Test
• Benchmark Test
• No Test - Explain why

Type of change

• Bug Fix (non-breaking change which fixes an issue)
• New Feature (non-breaking change which adds functionality)
• Breaking Change (fix or feature that could cause existing functionality not to work as expected)
• Documentation Update
• Refactoring
• Performance Improvement
• Other (please describe):

---

This change is 

[bohutang]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".