Add support for ARNs with paths.

[mattlandis]

IAM ARNs can have paths (ex.
arn:aws:iam::123456789012:assumed-role/org/team/rolename/session). When
normalizing the assumed role the output only contained the first part of
the path after assumed-role.

This should fix #98 .

[christopherhein]

👏 👏 👏 Nice work @mattlandis

[nckturner]

Looks good to me.

[nckturner]

👍

[jpb]

Has anyone had success using IAM roles with paths with this fix? From what I've seen anecdotally, assumed roles do not encode the role's path in their ARN, and AWS documentation appears to confirm this:

Assumed role ARN format:

arn:${Partition}:iam::${Account}:assumed-role/${RoleName}/${RoleSessionName}

compared to the role ARN format:

arn:${Partition}:iam::${Account}:role/${RoleNameWithPath}

[M00nF1sh]

I have tested it works with some caveats:
suppose i have an role named arn:aws:iam::283511030707:role/dev/product/m00nf1sh, I need to configrue mapRoles with arn:aws:iam::283511030707:role/m00nf1sh instead of arn:aws:iam::283511030707:role/dev/product/m00nf1sh to make it work. (this can cause potential privilege escalation)

BTW, in the pr, parts[len(parts)] is the SessionName. should be parts[len(parts)-1] is the SessionName. and arn:aws:sts::123456789012:assumed-role/Org/Team/Admin/Session should be arn:aws:sts::123456789012:assumed-role/Admin/Session(since assumed-role doesn't contain path)