[emmanuelgautier]

Closes #17

Summary

• Adds an AWS Cognito user pool target: import cognito, diff cognito, validate --target cognito, and job create --target cognito.
• Cognito has no API that returns or accepts a password hash, so users are created without their password. Each gets a random permanent password nobody knows (so they can use "Forgot password"), and users that had a password are listed under requires_password_reset. Blocked users are disabled.
• Requests are signed with SigV4 using the standard library (no new dependency). Credentials come from flags or the usual AWS_* variables; the region defaults to the one in the pool ID; --endpoint-url reaches an emulator.
• Users are created under their email, else username, else phone; the identity.primary strategy overrides that for pools that sign in by username. --upsert updates only the attributes that differ.
• New Capabilities.NoPasswords flag so validate doesn't flag every password hash as unsupported for a target that takes none.
• Docs: import guide, import-cognito / diff-cognito reference pages, README and mapping/strategy reference updates.

Testing

• Unit tests for the signer (checked against AWS's published SigV4 vector), the client, the connector against a fake pool, validation, target fields and flag resolution.
• Ran validate, import, rerun, upsert and diff end to end against Moto, on a pool signing in by email and one signing in by username.
• Not tested against a real AWS account.