[fast-lane] feat: add CKV_AWS_394 - Ensure DynamoDB table has deletion protection enabled

[SatyamJadhav007]

Description

This PR adds CKV_AWS_394 — a check that ensures aws_dynamodb_table resources have deletion_protection_enabled set to true.

DynamoDB already has checkov coverage for encryption (CKV_AWS_119), point-in-time recovery (CKV_AWS_28, CKV_AWS_165), and replica CMK usage (CKV_AWS_271), but there was no check for deletion protection. Since DynamoDB tables often hold critical application state, accidental or unauthorized deletion without this flag enabled can result in irreversible data loss. AWS has supported deletion_protection_enabled on aws_dynamodb_table since Terraform AWS provider v4.55.

The check follows the BaseResourceValueCheck pattern (same structure as RDSDeletionProtection / CKV_AWS_139).

Tests

Three scenarios covered using hcl2.loads() per the contribution guidelines:

• deletion_protection_enabled = true → PASS
• deletion_protection_enabled = false → FAIL
• Attribute missing entirely → FAIL

All tests pass locally and flake8 reports no errors.

Checklist

• New check follows BaseResourceValueCheck pattern
• Unit tests included (3 scenarios: pass, fail, missing attribute)
• Tests use hcl2.loads() per contribution guidelines
• flake8 passes with no errors