Review Security Hub Findings and Fix Top

Review Security Hub findings (jaah security account), especially from the standards and fix top 5 that would close the gap the most

Reviewed the security account's Security Hub: the whole open standards gap was 2 FSBP controls (Route53.2, SES.3) failing in prod and dev. Fixed both in terraform (query log for the mail zone; SES TLS REQUIRE) with pin tests; resolved 6 stale AWS Health notices. PR #6805 queued to the merge lane; dev applies on merge, prod on the next promotion.