Add support for MFA when assuming a role

Feedback from #990, this adds support for MFA when assuming a role.
To enable this, in addition to role_arn and source_profile, you can
specify an mfa_serial option in your config file::

    [profile foo]
    role_arn = ...
    source_profile = development
    mfa_serial = .....

This is the the mfa arn/device id.  If an mfa_serial is
provided then a user will be prompted for the token code when
the AssumeRole call happens.

As mentioned in the original PR, for now when the temporary
credentials expire, an exception will be raised if MFA is
required.  We can look into updating this in the future to support
reprompting the user.  This only affects the case where the
credentials expire within the duration of the AWS CLI process.
Aside from some of the ``aws s3 cp/sync`` commands, the AWS CLI
is generally a short lived process so this won't affect the
common usage scenarios.