Expose AWS backup bucket external IDs #1106

Expose the remaining backup-bucket drift from #1088 after its API layer.

cloud backup bucket create/update --file should carry the AWS iamRoleExternalId field. Create follows the current request schema; update must distinguish omission (preserve), a string (replace), and explicit null (clear). Keep strict rejection of unknown configuration fields and cover the real binary's request bodies. Document the field and clearing behavior beside the existing backup-bucket instructions.

No new client methods are needed or intentionally omitted. This extends the existing drift stack above #1099 and preserves its Query API fix. Paid test-service provisioning is outside this task's approved scope.

API prerequisite: #1100. Implementation draft: #1101 in native stack #1095.