Add script reporting Terraform-managed vs unmanaged AWS resources

[ale210]

Adds scripts/aws-terraform-coverage.ps1 and scripts/README.md, reporting which resources in the incubator account (035866691871) carry a managed-by Terraform tag and which do not.

Resolves #199. Its dependency, hackforla/devops-security#172, is merged and verified live — gha-incubator now returns managed-by=terraform-devops-security.

Two deviations from the ticket

• PowerShell, not Bash + jq. Agreed with Alex. jq is not a dependency at all; JSON is parsed with ConvertFrom-Json.
• The tagging API is a backstop, not the enumerator. The ticket treats IAM as the one exception to a resourcegroupstaggingapi sweep. It is not the only one — the API under-reports nearly every service, because it largely indexes only resources that already carry a tag, which is the wrong bias for a report that exists to find untagged resources. In us-west-2: log groups 26 live / 9 returned, ECR 12/6, Secrets Manager 10/3, ACM 7/2, SSM 45/36, SNS 2/0, and Route 53 8 zones / 0.

So every service is enumerated natively and the tagging sweep runs last as a backstop. It currently adds zero resources, meaning the native collectors are a strict superset. The tagging API alone sees 203 resources; the script reports 486.

Other behaviour worth review

• Untaggable types are their own bucket, excluded from the managed/unmanaged ratio so they are not permanent false positives: IAM groups (as the ticket requires), plus AWS-managed KMS keys, service-linked IAM roles, and AWS-owned FARGATE capacity providers.
• Read-only is enforced, not just documented — Invoke-AwsCli refuses any subcommand that is not describe-*, list-* or get-*.
• ECS task definitions are reported as the current revision per family; there are 286 active revisions.
• Blind spots are printed after every run and documented in the README.

Verified against hackforla/incubator#155

Every claim in that hand-captured record reproduces: the VPC, incubator-prod ECS cluster, ASG, ALB, 7 us-west-2 ACM certificates, 8 of 8 Route 53 hosted zones and 2 of 3 Cognito user pools all come back unmanaged. No disagreement to report back to #155.

Scoped to local runs against an AWS profile. Scheduling it would need an OIDC role for hackforla/devops, which does not exist; out of scope per the ticket.