Add support for RDS IAM with dynamic credentials

[keymon]

On AWS RDS there is the option of use RDS IAM authentication, instead of static credentials.

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html

That requires the client to request a new password before connecting, as the passwords are only valid for 15m.

I am not sure if dbmate supports this at the moment, I couldn't find how to do it. If not, we need to modify it to support this connection mode.

As a workaround one can run a script before calling dbmate to do the migration:

PGPASSWORD=$(
   aws rds generate-db-auth-token \
        --hostname "${PGHOST}" \
        --port "${PGPORT}" \
        --region "${REGION}" \
        --username "${PGUSER}"
)

but the migration must be run within 15m

[keymon]

very interestingly, I came across this comment that proposes using a external file to pull the secret PGPASSFILE: prometheus-community/postgres_exporter#498 (comment)

[OJFord]

Does that worth with dbmate? I see PGPASSFILE is a libpq option (not say psql-specific) so maybe it does. Do you just specify user but no password in the DATABASE_URL, like postgres://user_with_passfile@example.com:5432/db?