fix(plugin-dynamodb): connect with SSO sso_session profiles after aws sso login

[datlechin]

Summary

• Drop dependency on ~/.aws/cli/cache (side-effect cache that only AWS CLI/SDK populates after a GetRoleCredentials exchange).
• Read OIDC access token from ~/.aws/sso/cache/<sha1>.json (what aws sso login actually writes) and call the SSO portal GetRoleCredentials endpoint directly, matching how AWS SDKs resolve SSO credentials.
• Support both modern sso_session and legacy SSO profiles. For modern profiles, resolve sso_start_url and sso_region from the referenced [sso-session ...] block.

Fixes #1333

Test plan

• Connect DynamoDB with an sso_session profile immediately after aws sso login --profile <p> (no other AWS CLI commands needed first)
• Connect with a legacy SSO profile (no sso_session, sso_start_url + sso_region directly on the profile)
• Missing or expired token shows "Run 'aws sso login --profile <p>'" message
• 401 from portal surfaces as session-expired error; 403 surfaces as role-not-accessible