Support AWS China Route 53 via AWS_REGION

[rejown]

Summary

This PR adds support for AWS China regions (cn-northwest-1, cn-north-1) in dns_aws.sh.

Problem

Previously, Route 53 API endpoint (route53.global.api.aws) and SigV4 signature region (us-east-1) were hardcoded, making it impossible to manage DNS records hosted on AWS China Route 53 using AWS China IAM credentials (InvalidClientTokenId / SignatureDoesNotMatch). Resolves #2722.

Solution

• Allow specifying AWS_REGION (e.g. cn-northwest-1 or cn-north-1).
• When an AWS China region is detected:
  • Route requests to route53.amazonaws.com.cn.
  • Scope the SigV4 signature to the specified China region.
• Persist AWS_REGION in account configuration for automatic renewal.
• Backward compatibility: If AWS_REGION is not specified, it falls back to route53.global.api.aws and us-east-1, preserving existing behavior for AWS Global users.

Tested

Verified in production with real certificate issuance on AWS China Route 53 (cn-northwest-1).

[github-actions]

Welcome
READ ME !!!!!
Read me !!!!!!
First thing: don't send PR to the master branch, please send to the dev branch instead.
Please read the DNS API Dev Guide.
You MUST pass the DNS-API-Test.
Then reply on this message, otherwise, your code will not be reviewed or merged.
Please also make sure to add/update the usage here: https://github.com/acmesh-official/acme.sh/wiki/dnsapi2
注意: 必须通过了 DNS-API-Test 才会被 review. 无论是修改, 还是新加的 dns api, 都必须确保通过这个测试.

[neilpang]

1. Base branch is master. Rebase onto dev and retarget.

2. Region="$AWS_REGION" is applied unconditionally, so it also changes the signing region for the global endpoint. AWS_REGION is the standard AWS SDK/CLI region variable (Lambda sets it as a reserved runtime variable), so any existing user who already has it exported to something else -- including the _use_instance_role / _use_container_role users this hook serves -- starts signing route53.global.api.aws with the wrong credential scope after upgrading and gets SignatureDoesNotMatch. The global endpoint requires us-east-1: "Route 53 in AWS Regions other than the Beijing and Ningxia Regions: specify us-east-1 as the Region." (https://docs.aws.amazon.com/general/latest/gr/r53.html)

3. cn-north-1 cannot be used as the signing region. Route 53 in the aws-cn partition is not regionalized: a single endpoint route53.amazonaws.com.cn with credential scope cn-northwest-1 for both China regions -- "Route 53 in the Beijing and Ningxia Regions: specify cn-northwest-1." (same page; botocore endpoints.json, aws-cn/route53: "hostname": "route53.amazonaws.com.cn", "credentialScope": {"region": "cn-northwest-1"}, "isRegionalized": false). So AWS_REGION=cn-north-1 signs with cn-north-1 and is rejected.

Both are fixed by one block, dropping the later Region="$AWS_REGION" line and the AWS_REGION="${AWS_REGION:-us-east-1}" reassignment:

case "$AWS_REGION" in
cn-*)
  AWS_HOST="route53.amazonaws.com.cn"
  Region="cn-northwest-1"
  ;;
*)
  AWS_HOST="route53.global.api.aws"
  Region="us-east-1"
  ;;
esac
AWS_URL="https://$AWS_HOST"

4. DNS-API-Test has never run in your fork (rejown/acme.sh has no workflow runs). It is required for every dnsapi change, modified ones included: https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Test

5. Add AWS_REGION to the wiki yourself via the Edit button: https://github.com/acmesh-official/acme.sh/wiki/dnsapi and https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Amazon-Route53-API