aws2 cli sso login should give option to force new session entirely

**Is your feature request related to a problem? Please describe.**
one problem I have encountered with AWS SSO is that when a user has already been mapped against an account, and is then assigned a new permission set against that account via being added to a group which has a permission set against that account, they must log out and log in again in order to be able to access these permissions

Specifically, I experienced this when I was added to a new SSO group with an additional permission set, against an account I already had a permission set mapped to (AWSAdministratorAccess). aws sso login seemingly logged me in on the cli - but I had an old browser session somewhere which hadn't invalidated its session (i.e. I had an existing session which didn't have the new permission set in). attempts to use the new permission set on the CLI failed with:
```
botocore.exceptions.ClientError: An error occurred (ForbiddenException) when calling the GetRoleCredentials operation: No access

An error occurred (ForbiddenException) when calling the GetRoleCredentials operation: No access
```
because the cli seems to be taking the same permissions as my old browser session (which is my default browser). It took a frustratingly long while to find that the cli doesn't actually update the session when one does aws sso login (and they have an existing sso session open on a browser) and that the only way for my cli to be able to access the new permissions was to log out on the browser and then log in again, then do aws sso login again

**Describe the solution you'd like**
enable the aws cli to be able to invalidate the old session (everywhere) and force a new session as an additional option to aws sso login; e.g.:
```
aws sso login --fresh
```