Limitations when using get_session_token

Currently when doing a test the code will use `get_session_token` when an execution role isn't provided or the credential chain being used doesn't have a session token.
https://github.com/aws-cloudformation/cloudformation-cli/blob/1d32b070d26cf6c8d17b03dc06190c08d5c9444b/src/rpdk/core/boto_helpers.py#L67

The [get_session_token](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sts.html#STS.Client.get_session_token) will return back credentials that have a few exceptions.
```
You cannot call any IAM API operations unless MFA authentication information is included in the request.
You cannot call any STS API except AssumeRole or GetCallerIdentity .
```

The result is if you are testing an IAM resource or using STS in your resource the tests will fail.

The workaround is to use an execution role.

Lee src/rpdk/core/boto_helpers.py en la llamada a get_session_token y luego reproduce el fallo al probar IAM o usar STS sin un rol de ejecución. Se considera terminado cuando la ruta de credenciales ya no hace que esas pruebas fallen y los casos afectados tienen cobertura; el issue no especifica el comportamiento de reemplazo previsto.

Escrito por el modelo de indexación a partir del texto del issue.