CloudWatch: Prefer webIdentity over EC2 role also when assuming a role (#23807)

Same as #23452 but for assumed roles.
When using service accounts (webIdentity) on EKS in combination 
with assuming roles in other AWS accounts Grafana needs to retrieve 
the service account credentials first and then needs to assume the 
configured role.

pkg/tsdb/cloudwatch/credentials.go

@@ -60,8 +60,8 @@ func GetCredentials(dsInfo *DatasourceInfo) (*credentials.Credentials, error) {
 			[]credentials.Provider{
 				&credentials.EnvProvider{},
 				&credentials.SharedCredentialsProvider{Filename: "", Profile: dsInfo.Profile},
-				remoteCredProvider(stsSess),
 				webIdentityProvider(stsSess),
+				remoteCredProvider(stsSess),
 			})
 		stsConfig := &aws.Config{
 			Region:      aws.String(dsInfo.Region),