Review and fix AWS Security Hub findings

Review Security Hub findings (jaah security account), especially from the standards and fix top 5 that would close the gap the most

Security Hub review: 0 open FSBP/CIS findings (93 FAILED all suppressed by owner-accepted risk rows). Fixed the one open CRITICAL (certifi in AWS's Synthetics layer under the prod canary) with a pinned Inspector rule + R-SOC-53, applied to the org root; 6 INFORMATIONAL/2 Health verified patched, pending timer or AWS-side. PR #6622 merged by the lane, Jaah Deploy succeeded. Memory: used mem-15203; proposed 0.