New Rule: Ensure SecurityHub is Enabled in A Region

Description
Check whether SecurityHub is enabled in a region.

Trigger
Periodic

#####################################
## Gherkin ##
#####################################

Rule Name:
SECURITYHUB_ENABLED_CENTRALIZED

Description:
verify that AWS SecurityHub is enabled, optionally if it is centralized in an specific AWS Account.

Trigger:
Periodic

Resource Type to report on:
AWS::::Account

Rule Parameters:
CentralMonitoringAccount (optional)
AWS Account where AWS SecurityHub should be centralized. It must be a 12-digit string.

Scenarios:
Scenario 1:
Given: The CentralMonitoringAccount parameter is configured
And: the CentralMonitoringAccount parameter is not a 12-digit string
Then: Return an error

Scenario 2:
Given: SecurityHub do not have any Finding configured
Then: Return NON_COMPLIANT

Scenario 3:
Given: SecurityHub has at least one Finding configured
And: No finding is enabled
Then: Return NON_COMPLIANT

Scenario 4:
Given: SecurityHub has at least one Finding configured
And: At least one finding is enabled
And: the CentralMonitoringAccount parameter is not configured
Then: Return COMPLIANT

Scenario 5:
Given: SecurityHub has at least one Finding configured
And: At least one finding is enabled
And: the CentralMonitoringAccount parameter is configured and valid
And: the CentralMonitoringAccount parameter is equal to the AwsAccountId in the lambda invoking_event
Then: Return COMPLIANT with an annotation mentioning that it is the centralized account.

Scenario 6:
Given: SecurityHub has at least one Finding configured
And: At least one finding is enabled
And: the CentralMonitoringAccount parameter is configured and valid
And: No MasterID configuration associated to the enabled finding(s) exists
Then: Return NON_COMPLIANT

Scenario 7:
Given: SecurityHub has at least one Finding configured
And: At least one finding is enabled
And: the CentralMonitoringAccount parameter is configured and valid
And: At least one MasterID configuration associated to the enabled finding(s) exists
And: No MasterID configuration associated to the enabled finding(s) matches the CentralMonitoringAccount parameter
Then: Return NON_COMPLIANT with annotation on no MasterID configured

Scenario 8:
Given: SecurityHub has at least one Finding configured
And: At least one finding is enabled
And: the CentralMonitoringAccount parameter is configured and valid
And: At least one MasterID configuration associated to the enabled finding(s) exists
And: At least one MasterID configuration associated to the enabled finding(s) matches the CentralMonitoringAccount parameter
Then: Return COMPLIANT

Review existing Python AWS Config custom-rule implementations in the repository to identify the expected rule entry point, parameter validation, SecurityHub API usage, and test patterns. Implement the SECURITYHUB_ENABLED_CENTRALIZED behavior for all eight scenarios, including compliance status and annotations, then run the relevant rule tests and verify the documented outcomes.

Written by the indexing model from the issue text.