Allow opt-in SSO token revoke when exchanging credentials with `aws configure export-credentials`

### Use case

`aws configure export-credentials` is the standard way to source AWS CLI's credential resolution chain into other tools, especially via `credential_process`. For profiles backed by IAM Identity Center, the chain materializes short-lived STS credentials by exchanging a longer-lived SSO access token cached on disk at `~/.aws/sso/cache/*.json`.

In trust contexts where the local user process is not fully trusted — e.g. when running AI coding agents that execute third-party code, package installers, or MCP servers — leaving a multi-hour SSO access token (plus its refresh token and OAuth client secret) on disk between credential refreshes is undesirable. The token grants access to *all* permission sets the identity is entitled to, not only the role being exchanged.

The existing escape hatch is `aws sso logout`, but that wipes every cached token across all profiles and sessions, which is too coarse for per-profile use and unsafe for users with concurrent SSO work in other shells.

### Proposed change

Add an opt-in flag `--revoke-sso-token` to `aws configure export-credentials`. When set, after the credentials have been emitted, the CLI:

1. Identifies the SSO token used by the active profile (via the `sso_session` cache key, or the legacy `sso_start_url` cache key).
2. Calls `sso.Logout(accessToken=...)` server-side to revoke the access and refresh token pair.
3. Removes the corresponding `~/.aws/sso/cache/.json` file.

No default behavior changes — the flag is opt-in. Other cached tokens (other profiles, other concurrent shells) are not touched. Errors during the revoke step are logged at DEBUG and do not affect the exit status, since the credentials have already been written to the caller.

### Why a flag (not a separate command)

`aws configure export-credentials` already encapsulates the full credential-resolution path and is the canonical `credential_process` entry point. Adding a flag here keeps the diff small and reuses the existing recursion-barrier and credential-resolution machinery.

### Notes

- Used as a `credential_process`, this turns each STS-credential refresh into a transient SSO-login → exchange → revoke cycle. The on-disk lifetime of the SSO token collapses from the IAM Identity Center session duration (8h default) to the duration of a single exchange. Documented in the help text.
- The existing `aws sso logout` keeps its broad-sweep semantics unchanged.

I have a draft PR ready for review and would happily open it if this direction is acceptable.