feat: add more auto-fix implements

feat: add 120 new auto-fix implementations (194→199 registered)

Adds fixes for: SNS/SQS public access policies, SSM document public
sharing, S3 ACL prohibition, Transfer Family FTP removal, Neptune/DocDB/
RDS snapshot public access, DynamoDB KMS encryption, ECS Fargate platform
version, EBS snapshot public access, EC2 launch template EBS encryption,
ALB/CLB desync mode, CodeBuild report group encryption, CloudTrail S3
public access, DocDB TLS, App Runner observability, Kinesis Video
retention, S3 KMS encryption, and shared IAM policy helpers.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

feat: add auto fix logic for rules

fix: filter bptools-* artifacts to avoid downloading Docker build cache

docker/build-push-action uploads a .dockerbuild cache artifact which
caused download-artifact to fail in release and deploy-pages jobs.
Add pattern: bptools-* to match only binary artifacts.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

feat: set md/command UA token dynamically per API call

Reads the service ID and operation name from the smithy middleware context
on each request and formats them as CLI-style kebab-case:
  "Amazon EC2" + "DescribeInstances" → "ec2.describe-instances"

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

feat: exec bptools immediately after install

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

feat: add more default blocklist items

feat: build User-Agent dynamically from runtime OS environment

- os/NAME#VERSION from runtime.GOOS + /proc/sys/kernel/osrelease
- md/arch#ARCH normalised from runtime.GOARCH (amd64→x86_64, arm64→aarch64)
- exec-env/VALUE from AWS_EXECUTION_ENV env var (omitted if unset)
- md/distrib#ID.VERSION parsed from /etc/os-release

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

feat: override User-Agent header to match AWS CLI format

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

feat: set bptools app ID in AWS SDK user agent

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>