Add CloudFormation template for Federated Identity (AWS)

[seanrathier]

Summary

closes https://github.com/elastic/ingest-dev/issues/8803

• Adds deploy/cloudformation/federated-identity-aws.yml — a single CloudFormation template that creates one read-only IAM role for Elastic Federated Identity (Cloud Connectors) across AWS integrations.
• The template grows incrementally: it carries only the permissions of integrations that are actually federated, one block per integration, mirroring the provider_permissions declared in that integration's package manifest in elastic/integrations. Grants are never added ahead of a declaration.
• This baseline covers GuardDuty only — the single integration federated in production today. Its AmazonGuardDutyReadOnlyAccess grant is carried over verbatim from the shipped cloud-connectors-guardduty template (it pre-dates provider_permissions; it converts to a mirrored block when the aws package gains declarations under elastic/ingest-dev#8800).
• The only required quick-create parameter is ElasticResourceId (used to derive the composite ExternalId).
• Registers the template in scripts/publish_cft.sh so it is uploaded to s3://elastic-cspm-cft/ as cloudformation-federated-identity-aws-{version}.yml on release.

Background

Part of https://github.com/elastic/ingest-dev/issues/8812

This template supports the Federated Identity auth path for Cloud Connectors. In Kibana's flow it is the fallback: the IaC Provider renders role templates dynamically from provider_permissions at onboard time, and Kibana opens this static template's quick-create URL (via the package's iac_template_url) only when that render fails.

Two earlier revisions of this PR took different approaches — one Enable* boolean parameter per integration with CloudFormation Conditions, then a single unconditional grant covering every agentless-enabled AWS integration upfront. Both are superseded by the incremental model: per-integration additions land as separate PRs stacked on this one, each paired with the elastic/integrations PR that declares the permissions it mirrors (first up: aws_securityhub, paired with elastic/integrations#20436).

Test plan

• Validate YAML with cfn-lint deploy/cloudformation/federated-identity-aws.yml (passes in pre-commit, along with the rain formatter)
• Deploy a stack in a test AWS account and verify the role is created with the GuardDuty managed policy
• Confirm stack outputs contain RoleArn and ExternalId, and that assuming the role with the composite ExternalId succeeds
• Run publish_cft.sh against a test S3 bucket to verify the upload entry works

🤖 Generated with Claude Code

[mergify]

This pull request does not have a backport label. Could you fix it @seanrathier? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.