Add gimme-aws-creds assumer

[jpts]

What changed?

Add support for the gimme-aws-creds helper as an assumer, which supports AWS accounts integrated with Okta directly via SAML. The program supports multiple versions of Okta, MFA configurations etc. so we don't have to reimplement any of that logic.

On top of the basic support, it has the following features:

• caches obtained temporary credentials via the secure storage mechanism
• parses the gimme-aws-creds config file, so we can use other credential providers for non-matching profiles
• limited support for headless credential_process based refresh. It depends on an opt in from the user (using either the --auto-login flag or config file setting), and a compatible version of the tool and Okta flow. It's opt-in because the user can't verify the device code, since it's hidden by the calling program.

Why?

Allows us to get credentials via Okta/SAML, which wasn't previously supported.

How did you test it?

granted compiled with go build -ldflags='-w -s -X github.com/common-fate/granted/internal/build.ConfigFolderName=.granted' ./cmd/granted

Tested over the last few months on multiple AWS accounts/orgs, including a mixed config with Identity Centre and other credential providers.

Potential risks

None

Is patch release candidate?

Yes, no breaking changes

Link to relevant docs PRs