Harden CloudFormation subscription filter classification

[GrahamCampbell]

Summary

• Surface unexpected CloudFormation errors while classifying subscription filters.
• Preserve missing-resource fallback so absent CloudFormation resources are still treated as external filters.
• Cover access-denied and missing-stack-with-Resource-name cases.

Tests

• npx mocha --config "test/mocha/unit.cjs" "test/unit/lib/plugins/aws/deploy/lib/check-for-changes.test.js"
• npm run lint
• git diff --check