When using environment variable credentials (`AWS_ACCESS_KEY_ID` etc)
that were expired, the CLI would proceed to retry calls involving those
credentials because the `ExpiredToken` error is marked as `retryable:
true`.

Because we have extremely aggressive timeouts for most of our SDK calls
(since the CloudFormation throttling limits are low and we generate a
lot of contention on them), calls can take up to 10 minutes to run out
of retries.

Try and detect `ExpiredToken` situations sooner and error out harder
without trying to recover from them.

This PR only handles the situation where there is a Roles to assume --
this works because calls to STS have a much lower retry count, and so
it only takes a couple of seconds to run out of retries and surface
the `ExpiredToken` to the CLI, which we can then use to abort early.

…le'ing.