add a CredentialProvider compatible with aws-sdk gem

so that people can hook directly in, without need to create a
subshell

also allows using the default keychain - some people keep their login
keychain secure enough and may not want to manage multiple keychains