CCIX-141: Derive OpenSearch region from ARN

[yti93]

Why

OpenSearch Wiz reports expose country codes such as US, AU, and IE through regionLocation, which Version Guard incorrectly emitted as AWS regions and broke downstream pricing lookups.

What

• Fall back to the AWS region in OpenSearch domain ARNs when Wiz supplies a non-region location
• Preserve valid report regions and avoid guessing from malformed or non-domain identifiers
• Add table-driven regression coverage for the affected mapping and boundaries

Risk Assessment

Low — normalization is limited to the OpenSearch region mapping, and only valid es domain ARNs are used as fallbacks.

References

• Linear: https://linear.app/squareup/issue/CCIX-141/version-guard-scanner-writes-wiz-country-codes-into-opensearch
• Verification: make test, make build-all, and scoped golangci-lint run ./pkg/inventory/wiz/... --timeout=5m
• Repository-wide lint also reports four pre-existing findings outside this change

Generated with Amp