Add e2e and int tests for guard diagnostics

[kddejong]

Description of changes:

Add e2e and integration tests for Guard diagnostics, covering the full diagnostic lifecycle through the LSP protocol.

E2E tests (tst/e2e/Diagnostics.test.ts) — real LSP client/server over JSON-RPC:

• Receive guard diagnostics when opening a template with violations
• Receive guard diagnostics when incrementally typing a new resource
• Detect public access configuration violations with message content assertion
• Diagnostics are cleared when a document is closed

Integration tests (tst/integration/diagnostics/Guard.test.ts) — TemplateBuilder with real GuardService:

• S3 bucket versioning violations detected, then resolved by adding configuration (YAML)
• S3 public access violations with severity and message assertions (YAML)
• IAM overly-permissive policy detection (YAML)
• S3 public access violations in JSON format

Test utilities:

• DiagnosticExpectationBuilder for declarative diagnostic assertions (source, message pattern, severity, count)
• TestExtension gains receivedDiagnostics tracking and mockWorkspaceConfig for settings
• Custom guard rules file (test-guard-rules.guard) for deterministic e2e testing

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.