Add revoke function

[jhmartin]

It'd be useful to add a RevokeSelf function so that a lambda can optionally intentionally revoke its credentials (useful for jobs that run infrequently).