New IaC type: AWS CloudFormation scanner

[alphacrack]

Summary

Add a new IaC type: AWS CloudFormation (YAML/JSON templates) scanner.

Context

Same factory extension pattern as the Pulumi issue — new IacScanner subclass + factory entry. See factory.py and scanners/base.py.

What to build

• scanners/cloudformation.py:
  • can_handle(path) — detect a CFN template: AWSTemplateFormatVersion or a top-level Resources: map with Type: AWS::..., in .yaml/.yml/.json.
  • scan() — load template(s), apply shared filters, return ScanResult with iac_type == "cloudformation".
• Factory registration, samples/cfn/, tests.

Considerations

• CFN detection is trickier than Terraform (.yaml is generic) — lean on the AWSTemplateFormatVersion/Resources heuristics and document the false-positive tradeoffs.
• Coordinate with the Checkov rules path — Checkov already supports CFN, so hybrid mode should "just work" once the scanner exists.

Acceptance criteria

• Detects CFN templates without misclassifying plain YAML.
• Shared filters applied.
• Factory + scanner + sample + tests.

Notes

Detection heuristics make this slightly harder than Pulumi. area:scanners, type:feature. Not a first issue, but well-bounded.