support for env var and aws temporary credentials

this enables both support for specifying credentials using env vars as well as for temporary aws credentials.

the behavior is:

* env vars always override the config file
* you can mix and match env vars and config file values
* use `AWS_SESSION_TOKEN` (env var) or `session_token` in the config file to leverage temporary credentials
* if either `AWS_SESSION_TOKEN` or `session_token` are found, then it assumes that temporary credentials should be used (and will therefore include the session token in calls to aws)

does this behavior make sense from a user perspective? what sucks?


@thbishop 

That doesn't ring a bell for me. I remember doing contexts to help with some of the models, but nothing around ENV vars.

/cc @brettweavnet-intuit