feat: add 4 Security Hub TLS checks (CKV_AWS_394-397)

[lourenco00]

Summary

Adds 4 new Terraform resource checks for AWS Security Hub TLS controls that currently have no native Checkov coverage:

Security Hub Control	Check ID	Resource	Logic
ELB.21	CKV_AWS_394	aws_lb_target_group, aws_alb_target_group	Health check protocol must be HTTPS (skips lambda, TCP/UDP/GENEVE)
ELB.22	CKV_AWS_395	aws_lb_target_group, aws_alb_target_group	Transport protocol must be HTTPS or TLS (skips lambda)
APIGateway.10	CKV_AWS_396	aws_apigatewayv2_integration	VPC_LINK integrations must have tls_config with server_name_to_verify
DMS.12	CKV_AWS_397	aws_dms_endpoint	Redis endpoints must not use plaintext (absent defaults to ssl-encryption)

Testing

• Each check has a fixture directory with pass, fail, and not-applicable Terraform resources
• Runner-based unit tests explicitly assert which resources pass and which fail
• All 520 existing tests/terraform/checks/resource/aws/ tests continue to pass

AWS Config Rule Mappings

• CKV_AWS_394 → elbv2-targetgroup-healthcheck-protocol-encrypted
• CKV_AWS_395 → elbv2-targetgroup-protocol-encrypted
• CKV_AWS_396 → Security Hub native control (no direct AWS Config equivalent)
• CKV_AWS_397 → dms-redis-tls-enabled