Add data transfer cost guardrail rules

What

First rules targeting data transfer spend: (1) VPCs running a NAT gateway without free S3/DynamoDB gateway endpoints (IaC + discovery); (2) NAT gateways with high data-processing charges (discovery).

Why

Data transfer is routinely a top-3 AWS bill line item and CloudBurn has no coverage today. Routing S3/DynamoDB traffic through NAT at $0.045/GB when gateway endpoints are free is one of the most common and most fixable AWS cost mistakes.

Details

• Rule 1: for each VPC with a NAT gateway, check for com.amazonaws.<region>.s3 / dynamodb gateway endpoints. Static evaluation over Terraform + CloudFormation resources and live evaluation both work; complements CLDBRN-AWS-EC2-2 (interface-vs-gateway endpoint) which assumes an endpoint already exists.
• Rule 2: NAT gateway BytesOutToDestination/processing volume above a threshold over the lookback window — complements CLDBRN-AWS-EC2-11 (idle NAT) at the opposite end of the usage curve, reusing the same CloudWatch dataset pattern.
• Lives in the ec2 module alongside the existing NAT/endpoint rules.
• Per repo policy, static coverage must be tested against both Terraform and CloudFormation inputs.

Start in the ec2 module by reading the existing NAT and endpoint rules, especially CLDBRN-AWS-EC2-2 and CLDBRN-AWS-EC2-11, then review the CloudWatch dataset pattern. Done means both VPC endpoint and high-NAT-processing rules support the stated static or live evaluations, with static coverage tested against Terraform and CloudFormation inputs.