fix(auth): enable AWS SDK SSO credential resolver

[bryantbiggs]

Summary

• Enables the sso Cargo feature on aws-config so AWS SSO profiles in ~/.aws/config resolve correctly via the SDK profile chain.
• Adds 4 multiple-versions skips to deny.toml for the RustCrypto v0.10-era duplicates (block-buffer, cpufeatures, crypto-common, digest) pulled in transitively by aws-sdk-sso's sha1 = "0.10" dep.
• Documents SSO in the ECR auth credential chain.

Closes #84.

Why

aws-config gates SSO credential resolution behind a Cargo feature; without it the profile resolver returns ProfileFile provider could not be built: This behavior requires following cargo feature(s) enabled: sso. The user reported failure was an AWS_PROFILE referencing an SSO session, hitting exactly this path.

No code changes — the SDK profile resolver picks up SSO automatically once the feature is compiled in. Users still run aws sso login (or equivalent) to populate the OIDC token cache; ocync only consumes the cache.

Cost evaluation

Metric	Before	After	Delta
Release binary	7,635,296 B	8,000,672 B	+365 KB (+4.8%)
Crates in lockfile	baseline	+9	aws-sdk-sso, aws-sdk-ssooidc, sha1, block-buffer, cpufeatures, crypto-common, digest, generic-array, version_check

Small delta thanks to release profile (lto = true, strip = true, codegen-units = 1) — most unreached SDK operations strip out, and the smithy runtime is shared with existing aws-sdk-ecr / aws-sdk-sts.

GitHub HEAD of awslabs/aws-sdk-rust (sha ed385962) and smithy-lang/smithy-rs were both checked — both still pin sha1 = "0.10". No open issue requesting a bump. Pinning to a newer SHA does not avoid the duplicates; the deny.toml skips are the right answer (matches the existing 6-entry pattern).

Test plan

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test (276 passed, 1 ignored)
• cargo deny check (advisories ok, bans ok, licenses ok, sources ok)
• npm run --prefix docs build
• Manual verification with an SSO profile (cannot reproduce in CI; the original reporter's chain=ProfileChain { base: Sso { ... } } log line is the exact code path now enabled)