Mount vend in the ECS container-credentials wire shape.

The COS host's FUSE client points AWS_CONTAINER_CREDENTIALS_FULL_URI at this route (HTTPS, with AWS_CONTAINER_AUTHORIZATION_TOKEN carrying Bearer <box store token>), and the AWS SDK re-fetches as each 15-minute STS session expires. This is a GET returning the ECS credential JSON contract because that is the one rotating-credential protocol every AWS SDK speaks over plain HTTP -- credential_process was tried first and lost: older vendored SDKs cap process output at 1 KiB, which an STS session token alone overflows.