Allow specifying an mfa tuple for a credentials source

[mattmatters]

This adds an additional step where you can specify an mfa tuple to return a different credential source.

We had a need to to dynamically build the credential source at runtime (fetching aws credentials for a role and using that in conjunction with a workload identity).

I was a bit unsure of the ergonomics of how the you all would like the argument to be shaped and if you want to allow specifying functions too.

Thanks again for this project it has been a huge help for us.