[Feature Request] Add CISA TALON (Pub/Sub) Logging Pattern

**Description:**

This PR proposes a standardized, lightweight pattern for TIC 3.0/NCPS logging via the **TALON (Pub/Sub Handoff)** model.

**Context & Problem:**
* **Blocker:** Current public documentation references the legacy "CLAW" (Dataflow) model.
* **Solution:** The GCP TALON model simplifies the requirement: Agencies simply stream logs to a Pub/Sub topic which CISA ingests directly (Identity-based authentication).
* **Goal:** Add an optional, "Push-Button" compliance toggle to Stellar using standard CFF modules.

**Proposed Architecture:**
* **Non-Invasive:** Logic is isolated in separate `.tf` files (`cisa_talon.tf`) within `01-resman` and `02-security`. It does not touch `main.tf` logic.
* **Configurable:** The entire feature is driven by a single `cisa_talon_config` variable object (defaulting to `enabled = false`).
* **Security-First:**
* **Dynamic Naming:** Topics use `${org_prefix}-cisa-talon-handoff` to support multi-agency landing zones safely.
* **Smart Filtering:** Uses a "Serverless-Aware" filter (`subnet` + `load_balancer`) to capture edge traffic often missed by standard flow log filters. Please have a security engineer check this to see if I'm missing anything.
* **IAM-Based:** Grants the specific CISA Service Account `Subscriber` access, eliminating the need for shared keys.

**Implementation Status:**
I have fully drafted the Terraform implementation (~30 lines of standard CFF configuration) including the variable interface and resource definitions.

**Next Steps:**
Please let me know if you would like me to push the code to this branch or share it as a Gist for review. I can provide the Terraform immediately if desired.