Remove stub secondary_role from awsenc config

[jgowdy-godaddy]

Summary

`secondary_role` was a config field that the parser accepted but every code path immediately errored with "chained role assumption is not supported yet":

• `awsenc-cli/src/auth.rs::ensure_supported_secondary_role`
• `awsenc-cli/src/serve.rs` try-transparent-reauth path

It's been shipped in that half-wired state since the aws-okta-processor migration landed, with no plan to implement actual chaining. The threat-model review flagged it as a footgun: a user who copies `secondary_role = { role_arn = "…" }` from a legacy config hits the error at `awsenc auth` time after typing their Okta password.

Rip out the dead code:

• `ProfileConfig.secondary_role` field and `SecondaryRoleConfig` struct removed
• `ResolvedConfig.secondary_role` field removed
• `ensure_supported_secondary_role()` + its unit test removed
• Runtime rejection blocks in `serve.rs` and `auth.rs` removed
• Test fixtures (`cache_disk_tests.rs`, config tests) updated

Not removed

• The migration tool's aws-okta-processor parser still detects and warns on `--secondary-role` in the source config and skips such profiles. That's a property of the other tool's config we read during migration, not awsenc's own schema.
• `serde` is configured without `deny_unknown_fields`, so existing awsenc TOML with leftover `[secondary_role]` sections keeps loading cleanly (unknown field silently ignored). Added `resolve_config_ignores_legacy_secondary_role_field_in_toml` test to lock that behavior down.

`DESIGN.md` Phase 5 roadmap line for chained AssumeRole replaced with an explicit out-of-scope note pointing operators at SDK-side role chaining.

Test plan

• `cargo test --workspace` — 272 tests pass across all 7 test binaries.
• `cargo clippy --workspace --all-targets -- -D warnings` clean.
• `cargo fmt --all -- --check` clean.
• CI green on macOS / Linux / Windows.