fix: rewrite artifact URIs for AWS::Serverless::Function in Fn::ForEach (#9117)

[bnusunny]

Which issue(s) does this change fix?

Close #9117

Why is this change necessary?

When an AWS::Serverless::Function (or any packageable resource) is generated inside an AWS::LanguageExtensions Fn::ForEach loop, sam package/sam deploy fails to rewrite its artifact URI (ImageUri, CodeUri, etc.) to the uploaded artifact. For image functions the deploy then fails with Image not found for ImageUri parameter, and sam deploy --resolve-image-repos crashes outright with 'list' object has no attribute 'get'.

There are two distinct root causes:

1. Artifact merge-back gap. After SAM CLI expands Fn::ForEach locally, exports (uploads) artifacts on the expanded copy, and merges the rewritten URIs back onto the original Fn::ForEach-preserving template, the static merge path (_update_foreach_with_s3_uris) (a) skipped !Ref-based collections entirely — collection_values was only built from literal lists, so !Ref FuncType yielded [] and the rewrite was skipped — and (b) for multi-value collections copied the first iteration's URI onto the shared body, which is wrong whenever iterations resolve to distinct URIs (always true for images, whose local tag encodes the per-iteration logical id).

2. --resolve-image-repos crash. sync_ecr_stack called SamLocalStackProvider.get_stacks(..., language_extensions_enabled=False) with the flag hardcoded, so the Fn::ForEach block was never expanded and the SAM translator crashed calling .get("Type") on the ForEach list value before it could resolve ECR repos.

How does it address the issue?

1. Merge-back: resolve !Ref collections via the existing resolve_collection (threading parameter_values/template through the merge path), then make a value-driven decision per artifact property — if all iterations' exported URIs are identical, copy the raw shared value (preserving object shapes like {S3Bucket, S3Key}); if they differ, defer to the existing Mapping + Fn::FindInMap machinery via a deferred_dynamic accumulator that the package callers combine with the pre-existing dynamic properties. This is artifact-agnostic (works for ImageUri, CodeUri, DefinitionUri, Content, dotted paths, etc.).
2. --resolve-image-repos: add a language_extensions_enabled parameter to sync_ecr_stack and thread the already-resolved flag through its three callers (deploy, guided deploy, package) so ForEach is expanded before the SAM translator runs.

What side effects does this change have?

• Static single-value / shared-artifact cases keep their existing behavior (single static copy; no Mapping emitted).
• Loop-variable (already-dynamic) artifact values continue through the existing Mappings path unchanged.
• New parameters are optional with backward-compatible defaults; existing callers/tests are unaffected.
• Known limitation (documented + guarded by a test): nested Fn::ForEach with a static image value falls back to legacy copy, since a static value carries no loop variable to build compound Mapping keys. Nested loops with dynamic values are unaffected.

Mandatory Checklist

PRs will only be reviewed after checklist is complete

• Review the generative AI contribution guidelines
• Add input/output type hints to new functions/methods
• Write design document if needed (Do I need to write a design document?)
• Write/update unit tests
• Write/update integration tests
• Write/update functional tests if needed
• make pr passes
• make update-reproducible-reqs if dependencies were changed
• Write documentation

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.