Add caching integration tests

[reyhankoyun]

Issue #, if available:

Description of changes:
Added caching integration tests:

• test_cache_after_secret_update: Real AWS secret rotation + cache staleness
• test_real_ttl_expiration_timing: Real time-based TTL with actual delays

Fixed GitHub Actions security vulnerability:

• Changed pull_request_target to only trigger on labeled events
• Eliminates race condition where unapproved code could execute with AWS credentials
• Each commit now requires explicit human approval via safe-to-test label
• Auto-removes label after use to prevent persistent approval

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.72%. Comparing base (cde666a) to head (019acf2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #138   +/-   ##
=======================================
  Coverage   91.72%   91.72%           
=======================================
  Files          14       14           
  Lines        2418     2418           
  Branches     2418     2418           
=======================================
  Hits         2218     2218           
  Misses        150      150           
  Partials       50       50           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[simonmarty]

This is going to silence all errors that come out of the GitHub API

You can use something like

          gh_status=$(gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/safe-to-test" -X DELETE | jq ".status" --raw-output)
          case $gh_status in
            200) echo "Label removed" ;;
            404) echo "Label not found — ignoring" ;;
            *) echo "unexpected HTTP $gh_status" && exit 1 ;;

to avoid that

[simonmarty]

One issue with doing this is that this will prevent re-driving integration workflows that fail due to causes outside of the code. Say there's an AWS outage while a workflow gets run, the label will get removed, then it will have to get re-added so that a new PR workflow can get triggered on the same commit, when in fact that relabeling should not be necessary from a safety standpoint, the commit has already been approved for integ tests by a person.

One way to get around this is to remove the safe-to-test label on the synchronize event like here