chore: Set up CDK Nag

[LeonLuttenberger]

Describe your changes

• Added CDK nag to modules that were missing CDK nag
• In the modules that had CDK nag, I downscoped the suppressions to resource-level rather than stack-level
• Modified unit tests so that we check for CDK nag violations when running the unit tests

Checklist before requesting a review

• I updated CHANGELOG.MD with a description of my changes
• If the change was to a module, I ran the code validation script (scripts/validate.sh)
• If the change was to a module, I have added thorough tests
• If the change was to a module, I have added/updated the module's README.md
• If a module was added, I added a reference to the module to the repository's README.md
• I verified that my code deploys successfully using seedfarmer apply

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[kukushking]

Thanks, this is great. CDK nag runs at synth, but we didn't have a way to capture those errors when PRs are raised unless we deploy the modules manually.