[noor1027]

JIRA Ticket:
BB2-5311

What Does This PR Do?

• Puts CodeBuild in the VPC: Attaches the test runner to private subnets so integration tests can resolve internal *.cmscloud.local endpoints.
• Fixes OpenTofu CI Failures: Removes the problematic node wrapper shim causing tofu init crashes and forwards failure logs to CloudWatch.
• Guards ALB SSL Listener: Adds ignore_changes = [certificate_arn] on the :443 listener to prevent unexpected certificate swaps on apply.
• Cleans Up Task Secrets: Removes unused SLSx development credentials from the ECS task environment

What Should Reviewers Watch For?

If you're reviewing this PR, please check for these things in particular:

Validation

• tofu plan ran successfully with expected diffs.
• CloudWatch logs verified for OpenTofu test runs.

What Security Implications Does This PR Have?

Please indicate if this PR does any of the following:

• Adds any new software dependencies
• Modifies any security controls
• Adds new transmission or storage of data
• Any other changes that could possibly affect security?

• Yes, one or more of the above security implications apply. This PR must not be merged without the ISSO or team
  security engineer's approval.

Any Migrations?

• Yes, there are migrations
  • The migrations should be run PRIOR to the code being deployed
  • The migrations should be run AFTER the code is deployed
  • There is a more complicated migration plan (downtime,
    etc)
• [ X] No migrations

[ryan-morosa]

Nice work!