fix(query): ecs_cluster_not_encrypted_at_rest initial implementation

[cx-andre-pereira]

Closes #7093

Reason for Proposed Changes

• Refer to pull request 7586 for further context.
• This PR is meant exclusively to preserve the initial implementation fix for the "ECS Cluster Not Encrypted At Rest" query.

Proposed Changes

• Implemented the correct logic for "ECS Cluster Not Encrypted At Rest". This query must detect if the cluster is or isn't encrypted at rest to properly flag. This encryption is set on by the "Encrypted" field inside a LaunchTemplateData.BlockDeviceMappings.Ebs field of the "AWS::EC2::LaunchTemplate" resource's "Properties" block (doc); alternatively the BlockDeviceMappings field set in an AWS::EC2::Instance can overwrite the values set in the template and so is also checked. This should ensure any EC2 instance that is declared is encrypted and account for most "ECS clusters" use cases but , as suggested per the linked documentation, could require improvements for scenarios not accounted for. The query will flag in case the path to the "Encrypted" field is incomplete or in case the field is set to false.

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.11

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0