Add detection of AWS API calls that return credentials

[guyacosta]

This can enhance authentication detection and in fact is an example of other types of API's that may do similar things but that are not yet in the ruleset.

https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a