Add mfa_process config

[mtibben]

Addsmfa_process to the aws config that works similarly to credential_process.

This will allow us to remove the "pass" prompt while allowing flexibility for those who wish to use a password manager to generate TOTP tokens.

Note that use of mfa_process is generally not considered best practice - instead it is recommended that you use a dedicated device for MFA.

[tavisrudd]

Could the implementation be extended to pass mfa_process the mfa_serial for the current profile either as positional argument or as an environment variable? Alternatively, the mfa_process string could be templated or regex expanded before executing it to allow something like {{mfa_serial}} to be filled in. This would reduce clutter and typo opportunities in ~/.aws/config.

Fyi, I'm using pass otp with gpg from a yubikey so it's not the full anti-pattern you mentioned in #1006.

[mtibben]

Environment variable seems reasonable, I'd prefer to avoid templating. Feel free to open a PR