Add CloudFormation template for Federated Identity (AWS)

[seanrathier]

Summary

• Adds deploy/cloudformation/federated-identity-aws.yml — a single static CloudFormation template that creates one read-only IAM role granting the permissions required by all agentless-enabled AWS integrations.
• The only required parameter is ElasticResourceId (used to derive the composite ExternalId). No per-integration toggles: policies are grouped into five inline policy resources — Transport (S3 read / SQS consume / CloudWatch Logs read), Metrics, Security Findings (Security Hub, Inspector, Config, CloudTrail), Service Inventory, and Security Posture (CSPM / Cloud Asset Inventory / KSPM-EKS supplemental reads, sourced from the per-package IaC patches in [WIP] Support dynamic IaC for integrations integrations#20240) — plus the AmazonGuardDutyReadOnlyAccess and SecurityAudit managed policies. CNVM is deliberately excluded: its scan operations need write access and keep their own dedicated template.
• Registers the template in scripts/publish_cft.sh so it is uploaded to s3://elastic-cspm-cft/ as cloudformation-federated-identity-aws-{version}.yml on release.

Background

Part of https://github.com/elastic/ingest-dev/issues/8887.

This template supports the Federated Identity auth path for Cloud Connectors across the AWS package's agentless integrations, replacing the GuardDuty-only cloud-connectors-guardduty.yml as the target of Kibana's quick-create URL. A single all-permissions template means users deploy one stack and never need to update it when they enable additional integrations, and Kibana needs no changes beyond pointing iac_template_url at the new template (elastic/integrations PR to follow).

An earlier revision of this PR parameterized the template with one Enable* boolean per integration, attaching policies via CloudFormation Conditions. That was dropped in favor of the simpler unconditional grant — see commit history. The long-term plan remains for elastic/cloud-iac-provisioner to generate role policies dynamically; this static template serves as the bridge until that IaC path is available.

Test plan

• Validate YAML with cfn-lint deploy/cloudformation/federated-identity-aws.yml (passes in pre-commit)
• Deploy a stack in a test AWS account and verify the role is created with the four inline policies + GuardDuty managed policy
• Confirm stack outputs contain RoleArn and ExternalId, and that assuming the role with the composite ExternalId succeeds
• Run publish_cft.sh against a test S3 bucket to verify the upload entry works

🤖 Generated with Claude Code

[mergify]

This pull request does not have a backport label. Could you fix it @seanrathier? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.