fix: Migrate EventBridge rules to EventBridge Schedule

[uthiag-aws]

What changed and why

Migrate scheduled compliance rules across 11 SRA solution templates from AWS::Events::Rule to AWS::Scheduler::Schedule.

EventBridge Scheduler provides features not available with EventBridge Rules, including timezone-aware scheduling, flexible time windows, and built-in retry policies with dead-letter queue support.

Resource migration (all 11 templates):

• Replace AWS::Events::Rule with AWS::Scheduler::Schedule
• Replace AWS::Lambda::Permission (events.amazonaws.com) with a dedicated AWS::IAM::Role for the scheduler principal (scheduler.amazonaws.com)
• Add aws:SourceAccount condition on the scheduler role for confused-deputy protection

New parameters added to each template:

• pFlexibleTimeWindowMode — OFF (exact) or FLEXIBLE (spread invocations to reduce thundering herd)
• pFlexibleTimeWindowMaxMinutes — window size when using FLEXIBLE mode (1–1440 minutes)
• pScheduleExpressionTimezone — IANA timezone for the schedule expression
• pScheduleRetryEnabled — opt-in retry policy (185 attempts over 24h with exponential backoff)
• pScheduleDeadLetterQueueArn — optional SQS DLQ for failed invocations

Templates updated:

• sra-account-alternate-contacts.yaml
• sra-ami-bakery-org-configuration.yaml
• sra-config-org-configuration.yaml
• sra-detective-org-configuration.yaml
• sra-ec2-default-ebs-encryption.yaml
• sra-inspector-org-configuration.yaml
• sra-patch_mgmt-configuration.yaml
• sra-s3-block-account-public-access.yaml
• sra-security-lake-org-configuration.yaml
• sra-securityhub-org-configuration.yaml
• sra-shield-advanced-configuration.yaml

Fixes #338

---

By submitting this pull request, I confirm that my contribution is made under the terms of the [Apache 2.0 license].

Apache 2.0 License