Fix SSM AMI aliases and clarify validation diagnostics

[satyakigh]

Issues:

Closes #184
Closes #339
Closes #357

Description of changes:

• Accepts EC2's documented bare resolve:ssm: AMI aliases for AWS::EC2::LaunchTemplate at Properties.LaunchTemplateData.ImageId. The exception is scoped to that resource, property, format, and prefix, so other invalid ImageId values remain rejected.
• Keeps the duplicate-primary-identifier finding for multiple AWS::S3::BucketPolicy resources targeting the same bucket, but replaces the generic message with guidance that explains the one-policy-per-bucket conflict and identifies the resources involved.
• Keeps conditional RDS instance-class validation while adding the Engine and, when applicable, LicenseModel values that selected the failing enum branch. This makes it clear when an instance class is valid generally but incompatible with the configured database engine.