Improve IAM token session evidence gates

[danyili2632]

Summary

• add IAM session/token assurance gates for device-code flow, push MFA protections, risk policy enforcement, refresh-token revocation, CAE coverage, and risky sign-in review evidence
• extend platform evidence guidance for Entra ID, AWS IAM Identity Center, and Google Workspace / Cloud Identity
• add output evidence fields and severity escalation examples so assessments distinguish generic MFA from tested token/session controls

Bounty

Addresses #1522.

I have read and agree to the CONTRIBUTING.md bounty terms. Preferred payment method can be provided privately after maintainer acceptance.

Validation

• git diff --check