Add AWS SSO integration (#136)

* feat: add AWS SSO support to client layer

Fix GetResource interface parameter order to match implementation.
Add UpdateEntitlement method to C1Client interface.
Add IsAWSPermissionSet detection in task.go.
Add output.JSON constant for format checks.

* feat: add `cone aws` commands for SSO integration

Add `cone aws setup` — configures SSO URL and regions, scans ConductorOne
for AWS permission set entitlements, and creates ~/.aws/config profiles
with credential_process pointing to cone.

Add `cone aws credentials` — fetches temporary AWS credentials via SSO.
Automatically submits a ConductorOne access request if no active grant
exists, polls for auto-approval, and retries SSO login on expired tokens.

Add `cone aws setup show` — displays current SSO configuration.

* Fix checkC1Access to use caller's client, add AWS CLI check

checkC1Access was building a fake cobra.Command with hardcoded flags
just to call cmdContext() for a client. Since awsCredentialsRun already
has a client from cmdContext, pass it through instead.

Also add requireAWSCLI() check before shelling out to aws, so users
get a clear error message instead of an exec failure.

---------

Co-authored-by: Robert Chiniquy <rchiniquy@yahoo.com>

Author: afalahi