[AWS ControlTower] Denied Regions causes hundreds of AccessDenied

**Describe the bug**
CloudBeat for AWS is trying to get information on regions explicitly disabled in AWS ControlTower configuration (https://docs.aws.amazon.com/controltower/latest/userguide/region-deny.html). Which causes a lot of AccessDenied in CloudTrail logs.

Also may cause errors like (Client.UnauthorizedOperation) `You are not authorized to perform this operation. User: arn:aws:sts::xxxx:assumed-role/cloudbeat-securityaudit/aws-go-sdk-xxxx is not authorized to perform: xxxx with an explicit deny in a service control policy`

This "Region Deny" is basically managed by an AWS Organization SCP:

```
...
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": [
"eu-west-1",
"us-east-1",
"..." # any other enabled region in ControlTower
]
},
"ArnNotLike": {
"aws:PrincipalARN": [
"arn:aws:iam::*:role/AWSControlTowerExecution"
]
}
},
"Resource": "*",
"Effect": "Deny",
...
```

**Preconditions**
AWS ControlTower configured for the AWS Organization with some AWS Regions disabled

**To Reproduce**
1. Configure CloudBeat on an AWS Organization with AWS ControlTower configuration with specific allowed/disabled regions

**Expected behavior**
- No AccessDenied events

**Additional context**
- For cost management I think it would be better if we could manually select which regions we want to analyse.
- I would extend it by; Select region per AWS Organization account. But it's not currently a need/must for us.
- A simple Tree-like select with Accounts+Regions would be the perfect fit IMO.
- We analyse and have alerts based on these CloudTrail events. This completely makes CloudBeat not viable in our infrastructure for various reasons (audit included). It ceated tens or hundreds of "false" alerts on each execution.

Maybe related https://github.com/elastic/cloudbeat/issues/2331

Also thoughts on specific Account selection on https://github.com/elastic/cloudbeat/issues/2208#issuecomment-2551256086

Hope this gets fixed soon,