database-monitoring: run Elastio's encryption detector beside the agent (content_analysis) (#125)

Tracking: elastio/blue-stack#17198

## What changed

Adds `content_analysis` (default **false**) to
`aws-elastio-database-monitoring-agent` and bumps the module to
**0.2.0**.

With it on, Elastio's encryption detector (ED) runs as a second
container in the agent's task:
- **Where it comes from:** `ed_image`, built by
elastio/database-monitoring-agent from its pinned `elastio/ed` commit
for **arm64 and amd64**. The task stays ARM64.
- **User:** it runs as the agent's user (65532), which alone can read
the samples.
- **Network:** it listens on `127.0.0.1:50051`, loopback only.
- **Scratch volume:** it reads a task-local volume at
`/var/lib/elastio-dbmon-ed`, read-only, mounted at the same path as in
the agent, which writes it. It is never EFS.
- **Not essential:** if ED stops, the agent judges without a verdict
(which can raise a finding and never withholds one), and `restartPolicy`
brings ED back.
- **Memory:**
- ED gets 384 MiB, measured on the arm64 image with one worker: 158 MiB
idle and 231 MiB after a window.
- The agent's container is limited to the rest, and `GOMEMLIMIT` is 80%
of that share, not of the task.
- `content_analysis` needs `task_memory >= 1024`, enforced by a
validation.

Defaults move to agent **0.1.7** and
`elastio-database-monitoring-ed:0.1.7`. With `content_analysis = false`
the task definition is unchanged apart from the image tag.

## Order

**Merge after agent 0.1.7 is released.** The new default image tags only
exist once `agent-v0.1.7` is tagged, and the ED image also needs the ECR
repo from elastio/infraworld#2399. The agent change is
elastio/database-monitoring-agent#5.

## Verified

- `terraform fmt -check`, `terraform validate`, and `terraform test`:
17/17, 3 of them new:
- on: two containers, the detector runs as 65532 and is not essential,
it mounts the scratch volume read-only, the scratch volume is
task-local, the agent's memory is 640, `GOMEMLIMIT` is 512MiB, and
`ELASTIO_DBMON_ED_ADDR` is set;
  - off: one container, no ED variables, no scratch volume;
  - `task_memory = 512` with `content_analysis` is refused.
- Seeded defect: putting `GOMEMLIMIT` back to 80% of the task fails the
"on" run.
- `terraform-docs` 0.19.0 plus prettier regenerated the README, so the
terraform-docs job has no diff.
- The same ED image ran natively on arm64 as uid 65532 with `--workers
1` and passed the agent's gRPC contract tests.

## Not verified

- It hasn't been applied anywhere yet. UAT is next, after the agent
release.

---------

Co-authored-by: Anshuman Biswas <abiswas@elastio.com>

Author: anchoo2kewl

database-monitoring/terraform/.module.toml

@@ -1,6 +1,6 @@
 [module]
 name    = "aws-elastio-database-monitoring-agent"
-version = "0.1.0"
+version = "0.2.0"
 
 description = "Terraform module that runs the Elastio database monitoring agent on AWS Fargate"
 type        = "terraform"