Restrict CI role VPC and DNS guardrail

Found by Task 11845's security-review lane while closing Security Hub EC2.172 and Route53.2 in the apps account (jaah-apps). The account's CI role `jaah-apps-github-actions-deploy` (infra/jaah/terraform/org/apps-account.tf) carries `PowerUserAccess`, and no SCP in infra/jaah/terraform/org/policies/ denies it `ec2:ModifyVpcBlockPublicAccessOptions`, `ec2:CreateVpcBlockPublicAccessExclusion`, `route53:DeleteQueryLoggingConfig`, `logs:DeleteLogGroup`, `logs:DeleteResourcePolicy` or `logs:PutResourcePolicy`. A workflow in any `apps_github_oidc_repos` repository (on main, or naming any Environment) can therefore switch VPC Block Public Access off and delete the Route 53 query log the org root manages, and Security Hub only reports it afterwards. Add a deny for those actions to the SCP that binds the SDLC OU (or a permissions boundary on the CI role), exempting only `OrganizationAccountAccessRole`, in the shape the baseline SCP already uses for CloudTrail/Config/GuardDuty (infra/jaah/terraform/org/policies/baseline-scp.json.tftpl). Scope the `logs:*` denies to `arn:aws:logs:*:*:log-group:/aws/route53/*` if a portfolio app must manage its own log groups. Pin it in infra/jaah/test_org_policies.py. Out of scope: changing the CI role's PowerUserAccess grant itself; the dev account's role; anything outside the org root and its tests. Done means: - `python3 -m pytest infra/jaah/test_org_policies.py -q` has a test that renders the SCP and asserts the deny on those actions for the apps account's OU. - `terraform test` in infra/jaah/terraform/org passes. - `aws iam simulate-principal-policy` (or the SCP simulator) for `jaah-apps-github-actions-deploy` on `ec2:ModifyVpcBlockPublicAccessOptions` reports implicitDeny after the owner applies the org root. - `./dc check quick` green.

New apps-account SCP jaah-apps-guardrails denies the CI role VPC BPA changes and Route 53 query-log removal/weakening (admin role exempt); pytest + terraform test + quick gate green; review lane pass; PR #7496 queued. Owner: apply org root, then simulate. Memory: used mem-31981.