Add AWS FinOps checks to match Azure coverage

[raphgm]

The project currently has 27+ real, individually-verified Azure checks (idle Bastion, unattached disks, idle Cosmos DB throughput, idle Firewall, etc. — see src/cloudcost/sources/azure/) but AWS only has a basic billing source. AWS has direct equivalents worth building against real resources, verified the same way every Azure check here was (create the real resource, verify the finding fires, tear down, commit the real $ amount found):

• Idle/unattached EBS volumes (mirrors azure/unattached_disks.py)
• Unassociated Elastic IPs (mirrors azure/unassociated_public_ips.py)
• Idle NAT Gateways (mirrors azure/idle_nat_gateways.py)
• EC2 rightsizing via CloudWatch CPU metrics + real pricing (mirrors azure/vm_sizing.py)
• Idle RDS instances (mirrors azure/sql_dtu_metrics.py)

Use the AWS Pricing API (or the public pricing.us-east-1.amazonaws.com bulk JSON) for live prices, the same way Azure checks use the Retail Prices API — no hardcoded price tables.

Each check should follow the existing pattern: one source file in src/cloudcost/sources/aws/, one policy SQL file in policies/, registered in src/cloudcost/engine/runner.py.

[raphgm]

If you find this project useful, a ⭐ on the repo goes a long way — thanks!