feat: Export findings to AWS Security Hub in ASFF format

## Summary

Teams using AWS Security Hub as their centralized security posture dashboard should be able to ingest findings from this tool automatically without manual import.

## Proposed Change

After assessment completes, optionally push findings to Security Hub using the [AWS Security Finding Format (ASFF)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html). This should be opt-in via a SAM/CloudFormation parameter.

## Files Likely Touched

- New Lambda function or addition to `generate_consolidated_report` — batch import via `boto3.client('securityhub').batch_import_findings()`
- `aiml-security-assessment/template.yaml` — add optional `EnableSecurityHubExport` parameter and IAM permission for `securityhub:BatchImportFindings`
- `aiml-security-assessment/statemachine/` — wire optional Security Hub export step
- `docs/` — document the new parameter and setup steps for Security Hub custom product

## Acceptance Criteria

- [ ] New opt-in SAM parameter `EnableSecurityHubExport` (default: `false`)
- [ ] When enabled, findings are pushed to Security Hub post-assessment in ASFF format
- [ ] Product ARN and generator ID clearly identify findings as originating from this tool
- [ ] IAM policy for export is least-privilege and only attached when the parameter is enabled
- [ ] Findings include severity mapping aligned with ASFF `Severity.Label` (INFORMATIONAL / LOW / MEDIUM / HIGH / CRITICAL)

Start with generate_consolidated_report, template.yaml, and the state machine files under statemachine/. Trace how findings are produced and how optional deployment parameters and IAM policies are defined, then review the Security Hub ASFF requirements. Done means the opt-in parameter, conditional least-privilege permission, post-assessment export, severity mapping, product identity, and docs are covered.

Written by the indexing model from the issue text.