Is there a whys-and-wherefores doc somewhere about the various ways to construct aws.Provider instances? For example, I want to know when I should use assumeRoleWithWebIdentity, and when I should assume that the Pulumi program is running in an already-logged-in-by-SSO shell and just use assumeRole.