Fix for local-exec failure when updating trust policies.

[julialawrence]

https://dsdmoj.atlassian.net/browse/ANPL-1449

There were a few issues with the local-exec resource that is used to update trust policies of app roles:

1. The arn that sts assume role was being passed as a parameter wasn't a role arn but the arn of the session (ie: had assumed-role in the arn)
2. There was a problem with environment variables when using aws-vault to run locally, reporting an invalid session token error. This PR resolves both issues.

Changes in the PR

• Instead of using aws_caller_identity terraform datasource to get the caller arn, this uses aws_session_context which converts the session arn to the role arn used to the session. Passing this into the sts assume role command resolves the Access Denied and can't assume role errors.
• Inserts an if block into the local-exec command which unsets the AWS_SECURITY_TOKEN envvar if the caller identity is an SSO role (meaning the code is being run locally.) AWS cli appears to treat this envvar as higher priority than AWS_SESSION_TOKEN which caused Session token invalid errors. (ref: Pass credentials to local-exec OR extract credentials via properties hashicorp/terraform-provider-aws#8242 (comment))

Assuming no further errors, this PR has been tested to successfully amend trust policies of existing app roles to add the clause allowing assumption by CP service accounts.