Improve AWS credentials flow with entitlement IDs and step-aware polling

[afalahi]

Summary

• Store cone_app_id and cone_entitlement_id in AWS profiles so credentials can check grants directly without relying on aliases
• Pre-check for request forms before submitting — directs user to cone get if custom fields are required
• Check policy step during polling to give accurate feedback (approval needed, denied, provisioning) instead of generic timeout messages
• Handle 409 duplicate task errors by extracting and displaying the existing task number
• Retry credential fetch on ForbiddenException while AWS permission propagates after grant
• Display numeric task IDs in all user-facing messages

Example outputs

Auto-approved:

No active grant for "production-admin" — submitting access request...
Access request submitted (task: 1234)
..
Access granted!

Requires approval:

No active grant for "production-admin" — submitting access request...
Access request submitted (task: 1234)
.
Request submitted for "production-admin" but requires approval.
Check status: cone task get 1234
Once approved, retry the command.

Has form fields:

No active grant for "production-admin". This entitlement requires a request form — request access with:
  cone get --app-id X --entitlement-id Y

Duplicate request:

A pending request already exists for "production-admin".
Check status: cone task get 1234
Once resolved, retry the command.

Test plan

• Auto-approved entitlement returns credentials
• Entitlement requiring approval shows task number and stops polling immediately
• Entitlement with form fields never submits, directs to cone get
• Duplicate request shows existing task number
• Denied request reports denied
• AWS permission propagation delay retries until credentials work