Best-effort auto-close of the SSO login browser tab

[saipavan9]

Summary

Closes #9585.

After a successful aws sso login Authorization Code flow, the local callback page now makes a best-effort attempt to close its own browser tab, addressing the tab buildup that several users hit when authenticating frequently.

The change is intentionally small and lives entirely in the served callback page.

Behavior and caveat

Browsers only permit window.close() on a tab that was opened by script or that has a single session-history entry. aws sso login opens the browser via the OS default handler (webbrowser.open_new_tab), so:

• Warm re-auth (a pure redirect chain, single history entry) → the tab closes automatically. ✅
• Interactive login (sign-in form, MFA, "Allow access") → the tab has more than one history entry, so window.close() is a silent no-op. The page falls back to the existing success message, now reworded to tell the user they can close the tab themselves.

This matches how other CLIs behave (gcloud, az login, gh auth all display a "you may close this window" message rather than reliably closing the OS-opened tab), so the change is additive and cannot regress the current experience. The wording was deliberately made truthful ("This tab will try to close automatically, if it is still open, you can safely close it now") to avoid implying a guarantee the browser may not honor.

A code comment documents the constraint so the window.close() call isn't mistaken for dead code later.

Changes

• awscli/customizations/sso/index.html: attempt window.close() on a successful (non-error) callback. Reword the success message.
• tests/unit/customizations/sso/test_utils.py: regression test asserting the served callback page includes the close attempt.
• .changes/next-release/enhancement-sso-4703.json: changelog entry.

Testing

python -m pytest tests/unit/customizations/sso/test_utils.py tests/functional/sso/test_login.py

All tests pass; ruff check is clean.