auth: support MFA without assuming a role

## Problem
It's possible to use MFA devices combined with long-term credentials but the Toolkit does not support this. Example configuration:
```ini
[default]
aws_access_key_id = access_key
aws_secret_access_key = secret_key
mfa_serial = arn:aws:iam::1234567890:mfa/user
```

No prompt is shown when selecting this profile in the Toolkit

## Expected behavior
The Toolkit prompts for an MFA code and calls `GetSessionToken` on the user's behalf.

Start at the Toolkit flow that handles selecting an AWS profile, focusing on profiles with long-term credentials and mfa_serial. Trace how credentials are resolved and prompts are handled; done means selecting this profile prompts for an MFA code and uses GetSessionToken without assuming a role.

Written by the indexing model from the issue text.