Support security token in s3_generic_iam

Note: this patch breaks backwards compatibility for both s3_generic and
s3_generic_iam functions.

Sending the security token seems mandatory now for all requests using
temporary security credentials, which means it's necessary to send the
x-amz-security-token header with these requests. I have no idea if,
when, or how this changed.

This also means we have to generate the CanonicalizedAmzHeaders part
of the signature in the module. With this patch, it is not possible
to pass additional x-amz-* headers (the parameters was removed from
both functions), but ideally they should have a parameter accepting an
array of x-amz-* headers, add the x-amz-security-token header and
generate the canonicalized for from that.