fix: Replace plain SHA-256 with HMAC-SHA256 for remote function artifact integrity

[mollyheamazon]

Ticket: https://tiny.amazon.com/umah6gic/tcorpamazD403over

Issue

PR #5379 updated the integrity verification for remote function serialized artifacts by switching from HMAC to SHA-256 hashing. However, this approach has a gap
where the hash can be recomputed if the artifact is replaced, making the integrity check ineffective.

Solution

Re-introduce HMAC-SHA256 signing with the key stored in AWS Secrets Manager instead of environment variables (the original approach in pre-#5379). A trust anchor in SSM Parameter Store ensures the key reference cannot be tampered with.

Breaking change

This changes the serialization/deserialization format for remote function artifacts. Existing in-flight jobs will need to be re-run after upgrade.

New IAM permissions required

Execution roles used with @Remote / RemoteExecutor need:

Permission	Resource
secretsmanager:CreateSecret	arn:aws:secretsmanager:*:*:secret:sagemaker/remote-function/*
secretsmanager:GetSecretValue	same
ssm:PutParameter	arn:aws:ssm:::parameter/sagemaker/remote-function/*
ssm:GetParameter	same
sts:GetCallerIdentity	*

Testing

Validated end-to-end via notebook: https://tiny.amazon.com/kyowq0p4/drivcorpamazdocumollremoipyn

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.