ci: drop static AWS keys from athena profile, use workgroup (CORE-687)

The integration_tests dbt-athena profile is rendered with static
aws_access_key_id / aws_secret_access_key sourced from
CI_WAREHOUSE_SECRETS. Drop those — boto3 picks up the role credentials
exported by aws-actions/configure-aws-credentials in the calling
workflow (cleanup-stale-schemas.yml in elementary-cli) — and pin the
profile to the dedicated oss_tests Athena workgroup so query result
output and encryption are workgroup-enforced.

Mirrors the matching change in elementary-cli/tests/profiles/profiles.yml.j2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: haritamar

integration_tests/profiles/profiles.yml.j2

@@ -177,8 +177,7 @@
       region_name: {{ athena_region | toyaml }}
       database: awsdatacatalog
       schema: {{ schema }}
-      aws_access_key_id: {{ athena_aws_access_key_id | toyaml }}
-      aws_secret_access_key: {{ athena_aws_secret_access_key | toyaml }}
+      work_group: oss_tests
       threads: 4
 {%- endmacro %}