Rework credential configuration management

Credentials are now opaque objects except to the specific blob store
implementation that uses them.  This is to allow worker function
signatures to retain the same signature between backend storage
implementations even though different backends have different methods
of authentication that go beyond the account name/password approach.

While doing this, teach the S3 credential regime a 'security token'
parameter, which allows use of keys vended by AWS STS.
Add tests stressing AWS STS credentials and functionality
Remove dead parameter for .delete_all