Add exempt bucket to the AWS Terraform coverage report

[ale210]

Resources that are deliberately kept outside Terraform now carry managed-by = exempt, applied by hand rather than by a provider. The coverage report had no notion of that value, so it bucketed them as unmanaged and additionally listed them under "Tagged with an unrecognised managed-by value".

This adds exempt as a fourth bucket, excluded from the coverage ratio for the same reason untaggable is: counting a resource Terraform is never meant to touch as unmanaged makes it a permanent false positive.

Also documents the difference between the two exclusions, which is easy to miss — untaggable is a fact about AWS, while exempt is an assertion someone made by hand and nothing here verifies. That is called out in the README and added to the script's Blind spots output.

Verified against a live sweep of 035866691871:

terraform-incubator             180
terraform-devops-security        23
unmanaged                       119
exempt                            8

  203 of 322 in-scope resources carry a managed-by tag (63%).
  27 further resources cannot be tagged at all and are excluded from that ratio.
  8 are tagged managed-by=exempt and are excluded from it as well.

All 8 land in the new bucket and the "unrecognised managed-by value" section no longer fires.

The tag is being applied under hackforla/devops-security#176.