Summary

• When a role_arn is set in the IdP account, ParseAWSRoles has already extracted both RoleARN and PrincipalARN from the SAML assertion — so the subsequent HTTP POST inside ParseAWSAccounts is only used to fetch human-readable account names for the interactive picker, which is never shown in this case.
• That step has also become a hard failure for some AWS sign-in flows: AWS's commercial signin.aws.amazon.com/saml endpoint now responds to certain SAML POSTs with a small JavaScript hashArgs interstitial page instead of the legacy fieldset > div.saml-account HTML that ExtractAWSAccounts scrapes, so ExtractAWSAccounts returns an empty slice and resolveRole errors with No accounts available. despite the SAML assertion being valid and containing the configured role.
• This PR moves the RoleARN short-circuit ahead of ParseAWSAccounts so any RoleARN-configured account skips the unnecessary round-trip. The interactive multi-role picker path (no RoleARN, multiple roles in the assertion) is unchanged.

Repro

1. Configure an account with provider = Browser, a valid Okta AWS tile URL, and role_arn matching one of the roles returned in the SAML assertion (against an AWS account whose sign-in portal returns the new JS interstitial).
2. saml2aws --skip-prompt -a <account> login
3. Before: fails with Failed to assume role. Please check whether you are permitted to assume the given role for the AWS service.: No accounts available.
4. After: succeeds; STS AssumeRoleWithSAML returns the expected credentials.

The captured AWS response body in the failing case is roughly:

<script>
  window.location.replace(redirectUrl(window.location, "hashArgs", "oauthStart", ...).toString());
</script>

i.e. a JS-driven redirect rather than the legacy account selector HTML, which ExtractAWSAccounts has no selectors for.

Test plan

• Manual: saml2aws --skip-prompt -a <commercial-Okta-account> login — succeeds, STS returns expected credentials.
• Manual: GovCloud SAML flow (returns legacy account-selector HTML) still succeeds, and now skips the unnecessary ParseAWSAccounts HTTP call.
• go build ./... clean.