Add object lock configuration to augment table

[dmytro-afanasiev]

policies:
    - name: example
      resource: aws.s3
      filters:
        - type: lock-configuration
          key: Rule.DefaultRetention.Mode
          value: COMPLIANCE

[kapilt]

this should definitely be a separate filter, we're trying to slim augment table not add to it for s3, re not forcing api calls when they aren't explicitly needed for the policy.

[dmytro-afanasiev]

this should definitely be a separate filter, we're trying to slim augment table not add to it for s3, re not forcing api calls when they aren't explicitly needed for the policy.

changed to value filter

[kapilt]

afaics given the class value for annotate = true, there's no need for the conditional here.

[kapilt]

generally want a c7n: prefix on annotation keys to distinguish from native attributes.