Draft: Add --external-auth-cmd for AnyConnect SSO

Hi,

I've got this working for myself, and would like to contribute it here.
What would you want to see done to be able to merge this?

I haven't looked at writing tests at all, but could do that, though it might be annoying to test properly.
I haven't looked into localization either, I guess I'd at least need to generate the .po files.
I would definitely need to write more documentation.
I can't/won't develop on Windows so I'd rather not attempt to write code for it, and similarly can't test with non-AnyConnect protocols.

Relates to: #425