Add per-operation auth overrides.

This change makes several updates to support boto/boto3#30:

* Update the `before-auth` event to include operation name.
* Update the `before-auth` event to emit the operation model.
* Allow overriding auth by returning a non-`None` response before
  a request is sent over the wire.
* Add handlers for Cognito Identity `GetId` & `GetOpenIdToken` to
  prevent authenticating the requests.

This behavior is very similar to the [JS SDK](https://github.com/aws/aws-sdk-js/blob/42fbec2ee2d5f695e1cc6996da68e68fc908db50/lib/services/cognitoidentity.js)

cc @jamesls, @kyleknap