feat: Setup AWS Security Hub for compliance aggregation

[phertyameen]

Setup AWS Security Hub for compliance aggregation

Closes #757

What

• Enables Security Hub and subscribes to the CIS AWS Foundations
  Benchmark (v1.4.0) and AWS Foundational Security Best Practices
• Aggregates findings across regions via aws_securityhub_finding_aggregator
• Auto-remediates a narrow, allow-listed set of findings (S3 public
  access, S3 encryption, open security groups on high-risk ports) via
  EventBridge → Lambda, with idempotent fixes and an audit trail
  (finding notes + SNS alert)
• Generates a weekly compliance report (S3 + email) summarizing
  active findings by severity/status/standard

Files

• infrastructure/terraform/security-hub.tf
• infrastructure/lambda/remediation/index.py
• infrastructure/lambda/compliance-report/index.py
• infrastructure/scripts/remediate-findings.sh
• infrastructure/docs/compliance-hub.md

Design notes

• Remediation is allow-list only; unlisted finding types are left for
  manual triage
• Root-account/IAM findings are escalated via SNS, never auto-modified
• CLI script mirrors the Lambda logic for manual or SSM-driven runs

Required vars

• notification_email
• report_bucket_name

Follow-ups (not in this PR)

• Cross-account aggregation via AWS Organizations
• Historical trend tracking for the compliance report
• Expanding the remediation allow-list

[BigBen-7]

Thanks for contributing.