Run dialyzer in CI and clear the existing warning backlog

[lukebakken]

Dialyzer should run as part of GitHub Actions CI. It cannot be enabled today because gmake dialyze currently reports 30 warnings, so the job would fail immediately. This issue covers both halves:

1. Fix (or explicitly justify and suppress) all existing dialyzer warnings
2. Add a dialyzer step to the GHA workflow so regressions are caught

Most of the warnings are in the auth-validation subsystem (aws_auth_validate_*), with a handful of pattern-coverage and contract warnings elsewhere. Each should be triaged as either a real issue to fix or a genuine false positive to suppress with justification. The will never be called cluster in aws_auth_validate_ldap in particular should be confirmed as reachable-via--ifdef(TEST)-exports rather than genuinely dead code before suppressing.

Current warnings (as of this writing; line numbers will drift):

dialyzer warnings

aws_arn_config.erl:32: The variable Unexpected can never match since previous clauses completely covered the type
aws_auth_validate_ldap.erl:660: The call eldap:simple_bind ... breaks the contract
aws_auth_validate_ldap.erl:688: The variable _ can never match since previous clauses completely covered the type
aws_auth_validate_ldap.erl:711: Function post_bind_checks/2 will never be called
aws_auth_validate_ldap.erl:737: Function resolve_principal_dn/2 will never be called
aws_auth_validate_ldap.erl:770: Function check_dn_lookup/2 will never be called
aws_auth_validate_ldap.erl:797: Function check_authz_queries/2 will never be called
aws_auth_validate_ldap.erl:812: Function check_dns/2 will never be called
aws_auth_validate_ldap.erl:824: Function eval_queries/3 will never be called
aws_auth_validate_ldap.erl:845: Function eval_query/3 will never be called
aws_auth_validate_ldap.erl:883: Function eval_and/3 will never be called
aws_auth_validate_ldap.erl:894: Function eval_and_skip/3 will never be called
aws_auth_validate_ldap.erl:904: Function eval_or/3 will never be called
aws_auth_validate_ldap.erl:913: Function eval_or_skip/3 will never be called
aws_auth_validate_ldap.erl:923: Function eval_dn_probe/2 will never be called
aws_auth_validate_ldap.erl:935: Function eval_membership/4 will never be called
aws_auth_validate_ldap.erl:941: Function member_exists/4 will never be called
aws_auth_validate_ldap.erl:956: Function dn_str/1 will never be called
aws_auth_validate_ldap.erl:965: Function object_exists/2 will never be called
aws_auth_validate_mgmt.erl:187: The pattern <'ok', Req, Context> can never match the type ...
aws_auth_validate_mgmt.erl:194: The pattern <{'error', Category, Reason}, Req, Context> can never match the type ...
aws_auth_validate_mgmt.erl:198: Function status_for_category/1 will never be called
aws_auth_validate_mgmt.erl:219: The pattern ... can never match the type ...
aws_auth_validate_mgmt.erl:222: The pattern ... can never match the type ...
aws_auth_validate_mgmt.erl:263: The variable _ can never match since previous clauses completely covered the type
aws_auth_validate_mgmt.erl:294: The variable _ can never match since previous clauses completely covered the type
aws_auth_validate_registry.erl:41: Function effective_allowed_fields/2 has no local return
aws_auth_validate_registry.erl:43: The call application:get_env ... breaks the contract
aws_lib_config.erl:352: The pattern <Section, []> can never match the type ...
aws_sup.erl:67: The pattern 'infinity' can never match the type 100

[lukebakken]

Sequencing note: this should be one of the LAST items implemented for the 0.4.0 release. Clearing the dialyzer backlog means editing code across several modules, and the warning line numbers churn as other 0.4.0 fixes land. Doing this while other PRs are still open would create constant rebase/line-number conflicts and risk re-introducing warnings. Once the remaining 0.4.0 work has merged, fix the then-current warning set in one pass and enable the CI step.