aws/session: Add support for AssumeRoles with MFA

[jasdel]

Adds support for assuming IAM roles with MFA enabled. A TokenProvider
func was added tostscreds.AssumeRoleProvider that will be called each
time the role's credentials need to be refreshed. A basic token provider
that sources the MFA token from stdin as stscreds.StdinTokenProvider.

This change also adds a new session option, AssumeRoleTokenProvider.
The value of this field will be passed to the stscreds.AssumeRoleProvider
if the shared configuration is enabled and the config (~/.aws/config) or
credentials files (~/.aws/credentials) specify a role to assume
with MFA.

In order for the SDK to assume a role with MFA the SharedConfigState
session option must be set to SharedConfigEnable, or AWS_SDK_LOAD_CONFIG
environment variable set.

Creating an AssumeRoleProvider with MFA:

// Initial credentials loaded from SDK's default credential chain. Such as
// the environment, shared credentials (~/.aws/credentials), or EC2 Instance
// Role. These credentials will be used to to make the STS Assume Role API.
sess := session.Must(session.NewSession())

// Create the credentials from AssumeRoleProvider to assume the role
// referenced by the "myRoleARN" ARN. Prompting for MFA token from stdin.
creds := stscreds.NewCredentials(sess, "myRoleARN", func(p *stscreds.AssumeRoleProvider) {
    p.SerialNumber = aws.String("myTokenSerialNumberOrARN")
    p.TokenProvider = stscreds.StdinTokenProvider
})

// Create service client value configured for credentials
// from assumed role.
svc := s3.New(sess, &aws.Config{Credentials: creds})

Creating a Session with shared config enabled to assume a role with MFA:

sess := session.Must(session.NewSessionWithOptions(session.Options{
    AssumeRoleTokenProvider: stscreds.StdinTokenProvider,
    SharedConfigState:       session.SharedConfigEnable,
}))

// Create service client value configured for credentials
// from assumed role.
svc := s3.New(sess)

Fix #842
Related To hashicorp/terraform#9349

[xibz]

+1, way better name

[xibz]

Is there a reason why this isn't an interface but a function pointer?

[jasdel]

The switch here was focused on simplicity. Since an isolated piece of logic was being provided an function pointer was simpler and provided the same functionality.

[jasdel]

Added more detailed docs and verified with the stdin token provider is able to assume roles that require MFA.