Add RDS IAM instance identifier to config projection
There was no way to dynamically set rdsIam.dbInstanceIdentifier through the admin config API. When the rds-refresh tool created a temporary clone (e.g. dblab-refresh-20260305-164528), it couldn't tell DLE which RDS instance to use for IAM auth. DLE called DescribeDBInstances with a blank identifier, AWS returned all instances in the account, and the check for exactly 1 instance failed.
- added RDSIAMDBInstance to the config projection so it can be set via the API
- the rds-refresh tool now passes clone.Identifier to DLE when updating the config
- fixed the JSON serialization to produce the nested structure DLE actually expects
- refactored UpdateSourceConfig to use a parameter struct