2025.09 - requires access to GitHub for auto-scaling / self healing

**Is your feature request related to a problem? Please describe.**

`yq` is installed from github requiring further relaxation of Firewall rules to allow autoscaling or self-healing to be possible (already need to expose controlled repos). This is compounded in our environment as [LZA doesn't support TLS inspection](https://github.com/awslabs/landing-zone-accelerator-on-aws/issues/550) configuration to allow a more restricted firewall rule other than the domain.

**Describe the solution you'd like**

Pre built AMIs including dependencies provided as part of the RES release. Other benefits:

1. Reduced warmup on ASGs
2. More predictable
- Use of `latest` or `main` branch causing "works today" / "not tomorrow" have been encountered
- e.g. [109](https://github.com/aws/res/issues/109)
3. Lower risk to wider environment (egress protection)

**Describe alternatives you've considered**

* Manual add/remove permission from firewall rules during deploy
* auto-scaling/healing not possible
* Admin configured blocking of domains on user instances (current, but easily overlooked when new items added during deploy)
* Ubuntu: `/etc/host` loopback on restricted domains
* Windows: similar method, not implemented locally
* Manually adding TLS config to deployed LZA
* Fragile, not easy to use IaC, audit trail issues
* More complex networking to separate firewall rules for RES management hosts from VDIs
* Likely needing RES engineering to implement

**Additional context**

Active AWS support contract