Fix cfn-lint data sync bugs, engine behaviour divergences, other bugs

[satyakigh]

Engine-behavior / correctness bugs

• E3679 (classic ELB SSL cert): Rego's not object.get(..., null) never fired (null is truthy in Rego), so an absent SSL cert on an HTTPS/SSL listener was never caught. Now tests key-absence directly → fires correctly, and no longer false-positives on an empty-string cert (matches CEL + cfn-lint's presence-only required).
• E3025 / E3694 (RDS instance-class region validation): Two confirmed false-negatives fixed — Engine is now matched case-insensitively for DBInstance (cfn-lint lowercases it) and case-sensitively for DBCluster; and the class must be in the intersection of all matching allOf branches (was first-match-only). E3694 was also moved off a dead flat-enum path.
• E3706 (ASG MinSize≤MaxSize): now coerces string-form numbers ('10') and anchors at MaxSize.
• E3685 (Lambda Image excludes Handler/Runtime/Layers): collapsed to a single diagnostic at the first offending property, keyed on presence (fires even for unresolved Refs).
• E3671 (EBS Iops): reworked to validate BlockDeviceMappings[*].Ebs on launch configs/instances/launch templates/SpotFleet/OpsWorks with proper per-VolumeType bounds — instead of the old, wrong standalone-AWS::EC2::Volume check.
• E3702 (CodePipeline artifact counts): now enumerates Fn::If branches so a violation in any branch is caught, shared between engines via a builtin.
• W3663 (Lambda Permission SourceAccount): rewritten to fire when the SourceArn is an S3 bucket or an account-less literal ARN (was incorrectly keyed on Principal == s3.amazonaws.com).
• F3003 double-reporting: suppressed the generic Fatal required-property finding where a dedicated rule already covers it (S3 OwnershipControls→E3045, ELBv2 Certificates→E3676, RDS BackupRetentionPeriod→I3013). Closes issue F3003: required property isn't #54.
• cfnGather cross-resource checks: fixed nested JSON-pointer paths and string-form property specs that were silently dropped (making some cross-resource checks no-ops).
• ECS E3054, I3013 retention, ARN matching: absent-value handling, Fn::If [cond,X,NoValue] treated as possibly-absent, and short ARNs padded to 6 parts (no spurious mismatch).
• The line-number driver: template-model resource_span/diagnostic_span now normalize dotted paths (Properties.X) to the slash-keyed span index, so ~4,600 diagnostics anchor at their specific property line instead of falling back to the resource declaration line — this is why nearly all all_templates.json line numbers changed.
• GetAtt map-member over-suppression (E9004): the PR's new exemption keyed off a writable-property type map, so any dotted !GetAtt X.. (e.g. Bucket.Tags.0) was wrongly treated as valid → false negatives vs cfn-lint (E1010) in both engines. I narrowed it to cfn-lint's actual rule: valid only for Outputs. on AWS::ServiceCatalog::CloudFormationProvisionedProduct (nested Stack is already skipped).

Others

• E3001 → F3006: the region-availability check was removed from both engines (deleted structure/region.rego and the CEL region block) and moved into schema-validator as F3006 (message + Type anchor now match cfn-lint's E3006). The region map is now eagerly loaded, so the check runs at the default region.
• Lambda runtime deprecation (E2531/E2533/W2531): unified into one dated message reconstructed from lifecycle dates carried through the data pipeline; band→rule mapping matches cfn-lint.
• E3011 (property casing) removed: it was a false positive (cfn-lint's real E3011 is a name-length limit).
• Data pipeline: additional_specs.rs now emits per-runtime lifecycle dates; process.rs adds cfn-lint's hardcoded CodeBuild Name primary-identifier exception (E3019); regenerated data files (getatt attrs, region types, schema metadata, compiled schemas, ref types).