[Feature]: Offer optional advanced security features

### Description

Optional security features to add in terraform:
- WAF (applied on CloudFront distribution / API Gateway / Cognito) with a set of rules (customer can complete)
- All Lambda functions in VPC + endpoints
- Customer KMS key to encrypt everything (S3, DDB, Neptune)

### Use case

Enterprise customers might want additional level of security when deploying the solution, especially a WAF to protect the application / API / Cognito.

### Area

Infrastructure (Terraform)

### Additional context

_No response_

Start by reviewing the Terraform infrastructure and the AWS resources named in the issue: CloudFront, API Gateway, Cognito, Lambda, S3, DynamoDB, and Neptune. Determine how optional configuration should expose WAF rules, VPC endpoints, and customer-managed KMS encryption, then verify that each requested protection can be enabled independently without breaking the default deployment.

Written by the indexing model from the issue text.