Add opt-in Moen SSO (Cognito) auth for migrated accounts

[ajplotkin]

Problem

Flo accounts that have been migrated to the Moen Smart Water Network now
authenticate through Moen's SSO (Cognito), and api-gw.meetflo.com rejects the legacy
users/auth token with 401. For migrated accounts, the current flow logs in
successfully at api.meetflo.com/api/v1/users/auth but the returned token then fails on
every api-gw v2 call — which breaks Home Assistant's built-in flo integration (and
anything else built on aioflo) for those users.

Verified against a real migrated account:

• legacy users/auth token → 401 on GET api-gw.meetflo.com/api/v2/devices/{id} and /users/{id}
• POST oauth2/token {username, password, client_id} (no grant_type) → { "token": { "access_token", "refresh_token", "expires_in", ... } }
• that access token, sent as Authorization: Bearer <token>, → 200 on the same v2 endpoints

Only the auth changed; valve control etc. on api-gw v2 are unchanged.

Change

Adds an opt-in use_sso flag (default False, so existing behavior is unchanged):

• use_sso=True exchanges username/password at the SSO oauth2/token endpoint,
  uses the Cognito access token as a Bearer token, and resolves the user id from
  GET /users/me (the SSO token, unlike the legacy token, doesn't embed it).
• Legacy users/auth path is untouched and remains the default.

api = await async_get_api(username, password, session=session, use_sso=True)

Testing

Adds test_get_api_sso (plus sso_auth_success_response / sso_users_me_response
fixtures) covering the SSO flow and asserting the token is sent as a bearer token —
tests/test_api.py passes (4/4), including the existing legacy tests unchanged.

I also verified live against a migrated account that the use_sso path authenticates
successfully to api-gw.meetflo.com/api/v2/users/me.

Happy to adjust the default behavior (e.g. auto-detect / fallback) or the API shape
however you prefer — this is intentionally minimal and non-breaking.