Create organization variant of federated-identity-aws CFT and update CSPM/CAI manifest URLs

## Context

`deploy/cloudformation/federated-identity-aws.yml` is the new combined Federated Identity CFT covering the `aws` package integrations, CSPM (`cloud_security_posture`), and Cloud Asset Inventory (`cloud_asset_inventory`) under a single role. It replaces:

- `deploy/cloudformation/cloud-connectors-remote-role.yml` (CSPM single-account)
- `deploy/asset-inventory-cloudformation/cloud-connectors-remote-role.yml` (CAI single-account)

However, both CSPM and CAI also have organization-account variants that include StackSet machinery for deploying `cloudbeat-securityaudit` roles to member accounts across an AWS Organization. No organization variant of `federated-identity-aws.yml` exists yet, so the org-account manifest URLs cannot be updated until one is created.

## Definition of done

### cloudbeat

- [ ] Create `deploy/cloudformation/federated-identity-aws-organization.yml`:
- Same `ElasticFederatedIdentityRole` as the single-account template (GuardDuty, SecurityAudit, and all per-integration inline policies)
- Add `OrganizationalUnitIds` and `ScanManagementAccount` parameters
- Add `ScanManagementAccountEnabled` condition
- Add `CloudbeatRootRole`, `CloudbeatRoleStackSet`, and `CloudbeatManagementAccountAuditRole` resources — mirroring the structure of `deploy/cloudformation/cloud-connectors-remote-role-organization.yml`
- [ ] Add a `publish_cft.sh` entry for the new org template (prefix: `cloudformation-federated-identity-aws-organization`)

### integrations — `cloud_security_posture/manifest.yml`

- [ ] Update `cloud_formation_cloud_connectors_template` default URL (single-account) to `cloudformation-federated-identity-aws-9.x.0.yml`
- [ ] Update the org-account variant URL to `cloudformation-federated-identity-aws-organization-9.x.0.yml`
- [ ] Remove the `# ACCOUNT_TYPE value should be either...` comments from both entries

### integrations — `cloud_asset_inventory/manifest.yml`

- [ ] Same URL changes as above for `cloud_formation_cloud_connectors_template` (both single-account and org-account)

## Related

- Combined single-account CFT: elastic/cloudbeat#7637
- CSPM org variant reference: `deploy/cloudformation/cloud-connectors-remote-role-organization.yml`
- CAI org variant reference: `deploy/asset-inventory-cloudformation/cloud-connectors-remote-role-organization.yml`