Amazon OpenSearch Service end of support for TLS 1.0 and 1.1 protocols

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

22

### Amplify CLI Version

14.2.2

### What operating system are you using?

Mac

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No. N/A

### Describe the bug

Got an email from AWS today saying the TLS policy of the OpenSearch domain setup by amplify cli @searchable directive will be no longer supported as of April 2026:

```
We have identified that your account is currently using TLS policy "Policy-Min-TLS-1-0-2019-07" that supports TLS versions 1.0 and 1.1 on your OpenSearch Service.

To ensure continuous access to your OpenSearch Service domain, you will need to update your TLS policy to one of the following before this date:

1. "Policy-Min-TLS-1-2-2019-07"
2. "Policy-Min-TLS-1-2-PFS-2023-10"
```

This policy is set by amplify cli in the generated file at amplify/backend/api/MyGraphQLAPI/build/stacks/SearchableStack.json

### Expected behavior

amplify cli should update to use the latest TLS policy.

### Reproduction steps

Use seachable directive and examine the generated TLS policy.

### Project Identifier

3def1a2bd59d61900f734d59f169a578

### Log output

N/A

### Additional information

A workaround suggested by AI (not tested) is to override the TLS policy via a override.ts:

```
// Add TLS policy override
resources.opensearch.OpenSearchDomain.domainEndpointOptions = {
...resources.opensearch.OpenSearchDomain.domainEndpointOptions,
tlsSecurityPolicy: 'Policy-Min-TLS-1-2-2019-07', // or 'Policy-Min-TLS-1-0-2019-07'
};
```

### Before submitting, please confirm:

- [x] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [x] I have removed any sensitive information from my code snippets and submission.

Start with the @searchable directive generation path and inspect amplify/backend/api/MyGraphQLAPI/build/stacks/SearchableStack.json to trace where the TLS policy is assigned. Reproduce the issue with a searchable directive, update the generated policy to a supported TLS 1.2 option, and verify that the generated stack no longer uses Policy-Min-TLS-1-0-2019-07.

Written by the indexing model from the issue text.