feat: add inspector security rule packs

[nathanhuh]

Summary

This PR adds the first built-in Security Inspector rule packs with these checks:

• Security Groups: SSH exposed to 0.0.0.0/0 or ::/0, RDP exposed to 0.0.0.0/0 or ::/0, and unrestricted all-traffic ingress from the internet
• RDS: storage encryption disabled, public accessibility enabled, and automated backups disabled
• IAM: stale active access keys
• Secrets Manager: rotation disabled and rotation overdue
• S3: public ACL grants, public bucket policies, and disabled bucket versioning

It also enriches the RDS and Secrets models plus the S3 client interface so the scanners can evaluate live AWS state, and it updates Inspector UI copy and README to reflect the shipped rule coverage.

Related Issues

Closes #90
Closes #91
Closes #92

Validation

• GOCACHE=/tmp/unic-go-build make test
• GOCACHE=/tmp/unic-go-build make build

Checklist

• Scope is focused
• Branch name follows docs/branch-naming-harness.md
• Documentation harness reviewed (docs/documentation-harness.md)
• README updated if user-facing behavior changed
• Relevant docs/ pages updated if architecture, auth, config, or workflow changed
• Tests/validation included
• Breaking changes documented

[nathanhuh]

/q review

[amazon-q-developer]

Summary

This PR successfully implements built-in Security Inspector rule packs for AWS resources. The implementation is well-structured with comprehensive test coverage and proper error handling throughout.

Key Changes Reviewed

• Security scanning rules: Implemented checks for Security Groups (SSH/RDP/all-traffic exposure), RDS (encryption, public access, backups), IAM access keys (age-based alerts), Secrets Manager (rotation monitoring), and S3 buckets (public ACLs, policies, versioning)
• Model enrichments: Added essential security-related fields to RDSInstance and Secret models
• Interface extensions: Properly extended S3ClientAPI with required methods for security checks
• Test coverage: Comprehensive unit tests validate all scanner logic and edge cases

Review Result

No blocking defects found. The code is production-ready with:

• ✅ Proper error handling and nil checks
• ✅ Well-tested with table-driven tests
• ✅ Secure implementation of security checks
• ✅ Appropriate severity classifications
• ✅ Clean separation of concerns

The implementation correctly identifies security misconfigurations and provides actionable recommendations to users.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.