[sujen1412]

Refs #25 (items 1 and 3; item 2, failing the job on required-asset errors, is not included).

Behavior

For each STAC asset with a non-MAAP s3:// href:

1. Resolve the DAAC credentials endpoint, region and allowed buckets from CMR DirectDistributionInformation of the item's collection (provider, short name and version are parsed from the CMR-STAC collection link, e.g. .../stac/LAADS/collections/MYD06_L2_6.1).
2. Get temporary credentials with maap.aws.earthdata_s3_credentials(endpoint) (cached per endpoint, refreshed ~5 min before expiry) and download with boto3.
3. On any failure (no CMR info, item has no CMR link, credentials error, AccessDenied, bucket not in the collection's buckets) fall back to the https asset for the same file in the same item. An https asset whose file was already fetched over S3 is reused, not downloaded twice.
4. s3:// assets with no https sibling that fail are dropped with a logged error, as before.

STAGE_IN_DIRECT_S3=false disables direct S3. Non-MAAP s3:// hrefs no longer reach download_granule, which is HTTP-only (this removes the No connection adapters errors seen on UAT).

Tested

• 90 unit tests pass: preference for S3, fallback on failure, fallback when the collection has no direct-access info, S3-only asset dropped, credential caching, bucket allow-list, CMR ref parsing.
• Live: the CMR lookup resolves correctly for real LAADS items MYD03_6.1 and MYD06_L2_6.1 (endpoint https://data.laadsdaac.earthdatacloud.nasa.gov/s3credentials, bucket prod-lads).

NOT tested (please verify on a UAT worker before relying on it)

• Whether a DPS worker is authorized to get DAAC credentials through the MAAP API. If not, every direct attempt fails and falls back to https, so jobs behave as they do today but with extra log noise and a small delay.
• Actual S3 downloads from DAAC buckets (only mocked). Access works only from us-west-2.
• GES DISC buckets may be Requester Pays (unverified); not handled.
• Items without CMR links (e.g. copies stored in a workspace bucket) always use https.