RFC: Add `pii-protection` skill

## Summary

Add a standalone `pii-protection` skill to `aws-dev-toolkit` for stopping PII leaks in
AWS at the infrastructure layer — no application code change required. It pairs
CloudWatch Logs Data Protection (real-time masking of sensitive fields in live logs)
with Amazon Macie (discovery of PII already at rest in S3), routing HIGH-severity
findings through Security Hub -> EventBridge -> SNS.

## Motivation

The existing security skills (`security-review`, `iam`, `hipaa-assistant`,
`well-architected`) cover IAM, IaC scanning, and compliance frameworks, but none
address runtime data-protection: masking sensitive data already flowing into logs, or
discovering undiscovered PII sitting in storage. A leftover debug line like
`logger.info(json.dumps(event))` leaks national IDs, card numbers, emails, and phone
numbers into CloudWatch Logs forever — and founders under LGPD/GDPR/CCPA need a fix
they can ship in minutes, not a code refactor sprint.

## Proposed Solution

- New folder: `solution-architecture/plugins/aws-dev-toolkit/skills/pii-protection/`
- Single flat `SKILL.md` in dev-toolkit style (two-layer approach -> process ->
gotchas -> output table). No `references/` folder to start.
- Opinionated stance: **protect at the infra layer first, refactor code later.**
- Two layers: CloudWatch Logs Data Protection (live logs) + Amazon Macie (data at
rest in S3), with HIGH findings wired to Security Hub -> EventBridge -> SNS.
- Gotchas drawn from a real POC: region support for country-specific identifiers,
Macie's 2-10 min finding lag, `cdk destroy` not disabling Macie (ongoing billing),
Macie per-GB cost, and `logs:Unmask` as the audit escape hatch.
- Cross-link with `security-review`, `s3`, `observability`.

## Alternatives Considered

- **Fold into `security-review`** — rejected: that skill is a static IaC/config audit
checklist; runtime data masking and storage discovery are a different workflow.
- **Name it `macie` or `data-protection`** — rejected: no skill is named after a single
service, and `pii-protection` names the outcome the founder wants.

## Open Questions

- Name `pii-protection` vs `data-protection`?
- Keep it flat, or add a `references/` deep-dive on the two-layer CDK wiring?

## Drawbacks

- Adds to skill count. Managed data identifiers and Macie regional support change over
time and will need periodic refresh.

Inspect the existing security-review, s3, and observability skills under solution-architecture/plugins/aws-dev-toolkit/skills/ to follow dev-toolkit style. Create the proposed flat pii-protection/SKILL.md covering the two-layer process, listed gotchas, output table, and cross-links; done means the skill is self-contained and its open naming and references questions are resolved.

Written by the indexing model from the issue text.