Audit fixes: tags, ownership controls, naming, contact vars, LICENSE

[Manideep3969]

Changes

Final audit cleanup fixes based on code coverage and plagiarism/duplication audit:

Tags & Ownership Controls

• Add tags to 6 S3 buckets missing them (cloudtrail, vpc-flow-logs, alb-access-logs, data-classification, config-logs, control-tower)
• Add aws_s3_bucket_ownership_controls to 4 S3 buckets (vpc-flow-logs, control-tower, data-classification, mtls-trust-store)

Naming Consistency

• Rename IAM policies to use npci- prefix: ForceMFAPolicy → npci-force-mfa-policy, QuarterlyAccessReviewPolicy → npci-quarterly-access-review-policy, AccessAnalyzerIntegrationPolicy → npci-access-analyzer-integration-policy

Hardcoded Values → Variables

• Extract security-team@npci.org.in from cloudwatch-alarms to var.security_email
• Extract security@npci.org.in and +91XXXXXXXXXX from incident-response to var.security_email and var.security_phone
• Remove hardcoded account ID from setup-mtls-ca.sh — now requires AWS_ACCOUNT_ID env var

Security & Compliance

• Add Apache-2.0 LICENSE file
• Add soc.txt to .gitignore (contains sensitive assessment data)

What was NOT changed (and why)

• IAM policy ARNs like arn:aws:iam::aws:policy/... — these are correct AWS-managed policy ARNs with empty account ID
• S3 bucket code duplication — noted but deferred to a future refactor (extract s3-secure-bucket module)

Testing

• terraform validate passes
• 171 unit tests pass