feat: add readonlyRootFilesystem to ECS task definitions for enhanced…

[alismx]

Changes Proposed

• Added lifecycle policy for ECR repositories to keep the last 10 images.
• Enabled container insights for ECS clusters.
• Set readonlyRootFilesystem to true for all containers except 'trigger-code-reference'.
• Configured S3 bucket versioning, object lock configuration with compliance mode, and logging for both ecr_viewer and logging buckets.
• Added SSL-only policies for S3 buckets using IAM policy documents.
• Introduced new input variables auth_session_duration_min, ecr_viewer_object_retention_days, and logging_object_retention_days to control session duration, object retention days in compliance mode for ECR viewer and logging buckets.

Additional Information

• Decisions were made to enhance data protection and compliance by enabling versioning and setting object locks on S3 buckets.
• The SSL-only policies ensure that all requests to the S3 buckets are encrypted during transit.
• Default values were chosen based on common best practices, but they can be customized via input variables.

Address report items:

• ECR.1
• ECR.2
• ECR.3
• ECS.5
• ECS.12
• S3.15
• S3.9
• S3.5

Note: The DIBBS ECR viewer app team has reviewed this and didn't note any issues.