Initial commit of assume role cred provider

This builds on the work of several existing
pull requests combining what I believe is
the combination of all the suggested changes
including:

* Use role_arn to trigger assume role behavior.
  Do not require an explicit session to be created
  and ended (#667).
* Cache the temporary credentials.  If the credentials
  are not expired then we should reuse them instead of
  making the assume role call every time
  (#656 and boto/botocore#226).

I think a strong case can be made to move this to botocore.
However, the file caching makes me somewhat hesitant to move
this into botocore (but I think the AssumeRoleProvider without
the caching could be added to botocore).  I'd like to evaluate this in
the future but for now, I don't think it's unreasonable to leave
this in the AWS CLI for the time being.  At any rate, this is
a straightforward and compatible move if we decide to do so.

Also, the ability to open a browser with the currently scoped
session has not been ported over.  I'd like to address that
in a separate pull request.

cc @kyleknap @danielgtaylor