CRASM - 4247 ME report uploads and scoped S3 retention - #1710

🗣 Description

Add upload access for the two supplied ME instance roles to five report prefixes in cisa-was-reports:

cybex_scorecard/

cyhy_ad-hoc_notifications/

cyhy_vs_reports/

https_reports/

trustymail_reports/

Require HTTPS and SSE-KMS encryption using the approved customer managed key.

Enable 14-day expiration for these prefixes, with noncurrent-version, incomplete-upload, and delete-marker cleanup.

Preserve the existing HTTPS-only bucket policy. Leave ownership, ACLs, default encryption, and was_reports/ and capacity/ behavior unchanged.

Keep analyst download access independent of ME uploads.

Validation: Terraform 1.0.7 formatting and validation, 15 local mocked checks, and all applicable pre-commit checks passed. Test tooling remains outside the repository.

💭 Motivation and context

VS report requests currently depend on TechOps retrieving copies, which can delay customer inquiries and responses. This change establishes ME report uploads and the two-week temporary storage described in the ticket and supporting email while preserving existing WAS operations.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All future TODOs are captured in issues, which are referenced in code comments.
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
• AI was used for research and/or understanding purposes while creating this pull request.
  AI was used to generate code in this PR (either fully or in part).
  I attest that I understand the AI-generated code and its functionality.
  I am comfortable answering questions about the implementation of the AI-generated code.
• Tests have been added and/or modified to cover the changes in this PR.
• All new and existing tests pass.
• Create a pre-release (necessary if and only if the pre-release version was bumped).

✅ Pre-merge checklist

• Revert dependencies to default branches.
• Finalize version.

✅ Post-merge checklist

• Create a release (necessary if and only if the version was bumped).