sso delegation issue

## Problem
**When I tried to connect with the profile "sso-nvoperations" (described below) inside the AWS toolkit, I received the following error:**

2025-04-23 17:19:03.137 [info] auth: Updating connection state of profile:sso-nvoperations to authenticating
2025-04-23 17:19:03.157 [info] current client registration id=ku74xhaBzzvWxuve4I_oA2V1LXdlc3QtMQ
expires at Tue Jul 22 2025 16:55:42 GMT+0200 (heure d’été d’Europe centrale)
key = Nagravision_SSO
2025-04-23 17:19:04.212 [info] auth: Handling validation error of connection: profile:sso-nvoperations
2025-04-23 17:19:04.212 [info] auth: Updating connection state of profile:sso-nvoperations to invalid
2025-04-23 17:19:04.212 [error] _aws.toolkit.auth.reauthenticate: Error: Unable to authenticate connection
-> InvalidClientTokenId: The security token included in the request is invalid. (statusCode: 403; requestId: 179e0a8d-c659-497b-847c-12501516eec4)
2025-04-23 17:19:04.234 [info] current client registration id=undefined
expires at undefined
key = 0972b882-25a0-40d2-9422-f898a57b29fc
2025-04-23 17:19:04.234 [error] listAccounts() failed: Object was null or undefined, expected properties: accessToken
2025-04-23 17:19:04.234 [warning] auth: SSO org (kudelski) returned no accounts

**See my profile:**

[profile DTVSaaS-sre-ssp-vt-xxxxxxxxxxxxx]
sso_session = Nagravision_SSO
sso_account_id = 123456789
sso_role_name = DTVSaaS-sre-ssp-vt
region = eu-west-1
output = json

[profile sso-nvoperations]
source_profile = DTVSaaS-sre-ssp-vt-xxxxxxxxxxxxx
role_arn = arn:aws:iam::987654321:role/poweruser

## Steps to reproduce the issue

It works if I do it manually in a terminal. Hint: we have move to IMDSv2????!!!!!!

## Expected behavior

## System details (run `AWS: About` and/or `Amazon Q: About`)

- OS: Darwin arm64 24.1.0
- Visual Studio Code version: 1.99.2
- AWS Toolkit version: 3.55.0

Start by reproducing the AWS Toolkit connection flow with the sso-nvoperations and source profile configurations from the report, then compare its authentication requests with the terminal behavior and the provided logs. Trace the Toolkit SSO and role-delegation entry points; done means the delegated profile connects successfully without InvalidClientTokenId and lists its accounts.

Written by the indexing model from the issue text.