Add orphaned network resource rules

What

Discovery rules for orphaned resources that keep billing or hoarding after their parent is gone: unattached ENIs, unused security groups, and deregistration-candidate AMIs with their backing snapshots.

Why

Orphaned resources are classic silent waste in long-lived accounts, and there is demonstrated user pull — old issue #25 was specifically about unused security group detection.

Details

• Candidate rules: (1) ENI in available state (unattached); (2) security group referenced by no ENI/instance/LB — mind #25's lesson about coverage gaps in "in use" detection (referenced-by-other-SG rules, etc.); (3) old private AMIs no longer referenced by instances/launch templates/ASGs, flagged together with their backing snapshots.
• Security groups themselves are free, so that rule is hygiene-severity; ENIs and AMI snapshot storage carry direct cost.
• Discovery-only. ENI/SG rules extend the ec2 module (which already hosts VPC-adjacent rules like NAT and endpoints); AMI rule likely ec2 as well.
• Resource Explorer catalog-first per the architecture docs; hydration datasets for attachment/reference state via discoveryDependencies.

Start with the ec2 module and the architecture docs, then trace how Resource Explorer catalog-first discovery and discoveryDependencies provide attachment and reference state. Define discovery-only rules for available ENIs, unused security groups, and old unreferenced private AMIs with backing snapshots, including the coverage concerns from issue #25. Done means all candidate rules account for their stated references and severity distinctions.