Prompt for MFA before assuming a role

[ashishjullia]

Summary

• When a Portunus project sets AWS_ROLE_TO_ASSUME and AWS_MFA_SERIAL, startup asks for an MFA code before assuming that project's role.
• The role ARN, MFA serial, region, and IAM user keys all come from that project. A different dev <project>/<stage> can omit any of them.
• The one-time code is typed at the prompt and is not stored in Portunus.

Test plan

• dev with no project still opens a shell and does not ask for MFA.
• A project with keys and a role, and no AWS_MFA_SERIAL, assumes the role without a prompt.
• A project with AWS_MFA_SERIAL prompts for a code, then the caller is the assumed role.
• A wrong or empty code exits and does not open a shell as the IAM user.