pubsys: use base region for contacting STS

[zmrow]

The region used for the base credentials provider should be the one in which
you want to talk to STS to get temporary credentials, not the region in which
you want to talk to a service endpoint like EC2.  This is needed because you
may be assuming a role in an opt-in region from an account that has not
opted-in to that region, and you need to get session credentials from an STS
endpoint in a region to which you have access in the base account.

Note: this uses the first region in the given region list to talk to STS, the same way we use the first region to register an AMI and copy out from that region. I think we should have a separate discussion about whether these belong in separate settings, like base_region perhaps, since there has been some confusion about the region list.

Testing done:

• Reconfirmed ami, ami-public, and ami-private in standard regions.
• Confirmed that clients built with the updated method can now talk to services in opt-in regions from non-opted-in accounts. Before, you'd get a InvalidClientTokenId 403 error.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.