Support for rotating keys where the key rotation requires MFA

Recognises that a credentials profile called profileName::source_profile is the source credentials for profileName and that to rotate that key, use the credentials associated with profileName should be used. (These credentials will be short term credentials, obtained via the MFA cache mechanism, and so will be good to go (or easy to renew)).