c7n-org orgaccounts.py add flag to ignore specific OU's

[myoung34]

Describe the feature

Theres a flag in orgaccounts.py to include an OU, but we have multiple

I would like to exclude an OU and not explicitly list all of them to include.

Extra information or context

my current hack:

flags=$(for i in $(aws organizations list-children --parent-id r-trwk --child-type ORGANIZATIONAL_UNIT | jq -r '.Children[].Id'); do   org_id=$(aws organizations describe-organizational-unit --organizational-      unit-id $i | jq -r '.OrganizationalUnit | select(.Name == "someOUtoIgnore") | .Id');   if [[ -n ${org_id} ]]; then     aws organizations list-children --parent-id ${org_id} --child-type ACCOUNT | jq -r .Children[].Id;   fi; done | sed 's/^/ -i /g' | tr -d '\n')

python3 /orgaccounts.py --role "arn:aws:iam::{Id}:role/cloud-custodian" -f accounts.yml -a ${flags}