aws: ensure role assumption is done after other options are parsed

[troyready]

This fixes an issue introduced with the new feature in #3716 . Without this change, the options map is iterated over in a random order, which will cause issues if another parameter (e.g. region) is provided and needed.

Current tests don't catch this, but this part of the PR:

			if baseConfig.Region == "" {
				return aws.Config{}, fmt.Errorf("STS client created with empty region: all other parameters must be collected before assuming role")
			}

does exercise the tests -- if that same check was added to the current code, the current tests will fail sporadically.

[troyready]

Good thought, I agree -- @vangent ; updated.