Add VPC connectivity idle rules

[dannysteenman]

What

Discovery rules for always-on connectivity resources that outlive their purpose: Site-to-Site VPN, Client VPN, Transit Gateway attachments, Global Accelerator, and Route 53 Resolver endpoints.

Why

These are the classic "set up for a project that ended" resources — fixed hourly charges with no usage-based floor, invisible until someone audits:

Resource	Idle cost
Site-to-Site VPN connection	~$36/mo
Client VPN subnet association	~$73/mo each
Transit Gateway attachment	~$36/mo each
Global Accelerator	~$18/mo fixed
Route 53 Resolver endpoint	~$180/mo minimum (2 ENIs)

Details

Candidate rules (all discovery):

1. Site-to-Site VPN with both tunnels DOWN over the lookback window.
2. Client VPN endpoint with zero active/recent connections.
3. Transit Gateway attachment with no traffic (CloudWatch bytes metrics).
4. Global Accelerator with no processed bytes / no healthy endpoints.
5. Resolver endpoint (inbound/outbound) with no query volume.

• Module placement to settle during research: VPN/TGW sit on the EC2 API surface and could extend packages/rules/src/aws/ec2/ (which already hosts NAT/endpoint rules), while Global Accelerator warrants a new globalaccelerator/ module and Resolver extends route53/. The contiguous-ID convention makes this worth deciding before implementation.
• Each needs Resource Explorer type mapping + CloudWatch-metric hydration datasets, following the same pattern as CLDBRN-AWS-EC2-11 (idle NAT).