fix(cloudformation): inject ECS secrets via Secrets instead of plain Environment

[prpixie]

Move 10 secretsmanager entries to ContainerDefinitions Secrets, grant execution role GetSecretValue per approved plan on issue #419; implementation to follow.

Closes #419

[credfeto]

Roslyn analyzer findings

Source	Rule	Level	File	Line	Suppressed	Message
DotNet	IL2026	error	src/BuildBot/Helpers/Endpoints.CloudFormation.cs	26	yes	Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapPost(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet	CA2000	error	src/BuildBot/Helpers/ServerStartup.cs	122	yes	Call System.IDisposable.Dispose on object created by 'CreateLogger()' before all references to it are out of scope
DotNet	IL2026	error	src/BuildBot/Helpers/Endpoints.Test.cs	22	yes	Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapGet(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet	IL2026	error	src/BuildBot/Helpers/Endpoints.GitHub.cs	19	yes	Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapPost(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet	IL2026	error	src/BuildBot/Helpers/Endpoints.GitHub.cs	29	yes	Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapPost(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet	IL2026	error	src/BuildBot/Helpers/Endpoints.GitHub.cs	39	yes	Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapPost(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet	IL2026	error	src/BuildBot/Helpers/Endpoints.Watchtower.cs	19	yes	Using member 'Microsoft.AspNetCore.Builder.EndpointRouteBuilderExtensions.MapPost(IEndpointRouteBuilder, String, Delegate)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. This API may perform reflection on the supplied delegate and its parameters. These types may be trimmed if not directly referenced.
DotNet	IL2026	error	src/BuildBot/obj/Release/net11.0/Microsoft.AspNetCore.Http.RequestDelegateGenerator/Microsoft.AspNetCore.Http.RequestDelegateGenerator.RequestDelegateGenerator/GeneratedRouteBuilderExtensions.g.cs	1014	yes	Using member 'Microsoft.AspNetCore.Http.HttpResponseJsonExtensions.WriteAsJsonAsync(HttpResponse, TValue, JsonSerializerOptions, CancellationToken)' which has 'RequiresUnreferencedCodeAttribute' can break functionality when trimming application code. JSON serialization and deserialization might require types that cannot be statically analyzed. Use the overload that takes a JsonTypeInfo or JsonSerializerContext, or make sure all of the required types are preserved.

[dnyw4l3n13]

Fixed in 3b47f01: moved the secret-bearing ECS entries from Environment to Secrets (ValueFrom = secret ARN + json key), region now a literal, and added TaskExecutionSecretsPolicy (secretsmanager:GetSecretValue).

Re credfeto's Roslyn analyzer table: all findings are marked suppressed, are in C# files this PR does not touch, and need no action here.

Needs a human decision (Blocked):

1. The new AWS::IAM::Policy requires --capabilities CAPABILITY_IAM on aws cloudformation deploy, but .github/actions/cloudformation-deploy/action.yml is maintained in another repo, so the pre-commit check rejects changing it here. Either add the flag upstream in the template repo, or choose another approach (e.g. grant the permission on the execution role outside this template and drop the policy resource).
2. Is the secret encrypted with a customer-managed KMS key (needs kms:Decrypt)?
3. Is hardcoding region eu-west-1 acceptable?
   After deploy, rotate the exposed credentials.