feat(mysql-mcp-server): restore --secret_arn for custom-secret auth (#3643, #4099)

[warren830]

Issues

Fixes #3643. Closes #4099.

Problem

mysql-mcp-server 1.0.21 removed the ability to authenticate with an operator-supplied Secrets Manager secret: secret_arn is now derived exclusively from the cluster/instance's AWS-managed MasterUserSecret. This silently forces connections as the master user — a privilege regression (#3643) for setups that previously connected as a dedicated least-privilege user (e.g. read-only) via a custom secret. mssql-mcp-server still supports --secret_arn, so the two servers are also out of parity (#4099).

The connection layer (AsyncmyPoolConnection / RDSDataAPIConnection) already accepts an arbitrary secret_arn — server.py simply never exposed a way to set it.

Fix

• Add a --secret_arn CLI flag, wired exactly like the existing --ca_bundle (module global configured_secret_arn, declared in internal_connect_to_database and main, set from args.secret_arn).
• When provided, it overrides the derived MasterUserSecret ARN for the mysqlwire (non-IAM) and rdsapi methods.
• It is ignored for mysqlwire_iam, which authenticates via IAM and uses no secret (that path's secret_arn stays '').
• README documents the least-privilege use case.

Tests

Added to tests/test_server.py::TestInternalConnectToDatabaseRouting:

• --secret_arn overrides MasterUserSecret on the wire path;
• --secret_arn overrides it on the RDS Data API path;
• --secret_arn is not applied to IAM auth (secret_arn == '').

Strict red→green verified: neutralizing the override makes the two override tests fail (connection would use arn:master-user-secret); the fix makes them pass, and the IAM-ignored test passes both ways. Full test_server.py (28 tests) green; ruff check / ruff format --check clean.

Compatibility

No behavior change when --secret_arn is omitted (the managed MasterUserSecret is still used), so existing deployments are unaffected.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.