auth/aws: Fix panics when malformed ARNs are passed in

[joelthompson]

The parseIamArn method was making assumptions about the input arn being
properly formatted and of a certain type. If users tried to pass a
bound_iam_principal_arn that was malformed (or was the ARN of the root
user), it would cause a panic. parseIamArn now explicitly checks the
assumptions it's making and tests are added to ensure it properly errors
out (rather than panic'ing) on malformed input.

#3179 first reported the panic on the root ARN being passed in. #3181 fixed the
panic, but when it was reverted in #3212 it reintroduced the issue of Vault
panic'ing when the root arn was passed in. Vault should fail gracefully in these
scenarios :)

[jefferai]

Good catch!