Add public IPv4 address cost rules

[dannysteenman]

What

Rules flagging avoidable public IPv4 usage: subnets auto-assigning public IPs to workloads behind load balancers, and instances holding public IPs they don't need.

Why

Since February 2024 every in-use public IPv4 address bills $0.005/hr (~$3.65/mo). Trivial per address, material at fleet scale — hundreds of instances auto-assigned public IPs behind an ALB is a pure-waste line item AWS now reports on precisely because it's so common.

Details

1. Subnet with MapPublicIpOnLaunch: true — IaC review rule (Terraform map_public_ip_on_launch / CloudFormation AWS::EC2::Subnet); review severity since some subnets legitimately need it.
2. Instance with associate_public_ip_address: true (IaC) or an in-use public IP (discovery) while registered behind a load balancer target group — the LB terminates ingress, so the instance IP is typically unnecessary.

• Extends packages/rules/src/aws/ec2/; complements CLDBRN-AWS-EC2-3 (unassociated Elastic IPs), which covers the idle IP case — these cover the in-use but unnecessary case.
• Noise is the design risk: scope conservatively (LB-fronted instances first) and document exemption paths; a good early consumer of inline suppression (Support inline finding suppression in IaC scans #103).