feat: add a DescribeEc2 query type

[jakubramut]

Description of your changes

Why

Two identifiers can't be discovered through any existing query type:

• aws_main_route_table_association - its external name is the main association ID, which only ec2:DescribeRouteTables returns. The AWS::EC2::RouteTable CloudFormation schema has just RouteTableId, Tags, VpcId.
• Live subnets and route tables. GetResources keeps returning deleted resources: measured 16 entries for 10 real resources, the 6 stale ones carrying the same identifying tag as their live replacements.

ListResources is not a workaround. AWS::EC2::Subnet, AWS::EC2::SecurityGroup and AWS::EC2::SubnetRouteTableAssociation all publish no handlerSchema on their list handler, so Cloud Control cannot filter them server-side at all: it enumerates the type account-wide and hydrates each item, and in a shared account one foreign resource failing hydration aborts the caller's whole composition. A direct describe with a server-side filter reads only what was asked for.

What

queryType: DescribeEc2, with parameters.operation selecting RouteTables, SecurityGroupRules or Subnets. Reuses the existing toEC2Filters, so filters takes native EC2 names (vpc-id, group-id).

Tests

go build, go test ./..., golangci-lint run (v2.8.0, the CI pin) all clean.

Verified against real EC2 in eu-central-1 (VPC + subnets + route table + associations + security group with tcp, all-protocol and group-referencing rules), then torn down.
Live runs found two defects, both fixed here:

• securityGroupRuleArn was dropped from the rule projection; real DescribeSecurityGroupRules returns it on every rule. Now projected.
• the fixture assumed an ipProtocol: -1 rule omits ports. Real EC2 sends -1/-1. Fixture corrected, with a third rule keeping the genuinely-absent case covered.

Live runs also confirmed referencedGroupId unwraps from the nested ReferencedGroupInfo, rule tags project, and subnetId is populated for subnet associations and empty for the main one.