feat(aws): add rolesanywhere service and pqc trust anchor check

[pedrooot]

Context

IAM Roles Anywhere trust anchors are the root of trust for workloads that authenticate to AWS with X.509 certificates. A weak (RSA/ECC) signing CA could let a quantum-capable attacker forge certificates and gain unauthorized access. AWS now supports ML-DSA (NIST FIPS 204) trust anchors, and Prowler had no IAM Roles Anywhere service.

Description

Introduces the IAM Roles Anywhere (rolesanywhere) service and the rolesanywhere_trust_anchor_pqc_pki check. For trust anchors whose source is AWS_ACM_PCA, the linked Private CA's KeyAlgorithm is checked against a configurable allowlist (rolesanywhere_pqc_pca_key_algorithms, defaults: ML_DSA_44, ML_DSA_65, ML_DSA_87). Trust anchors backed by an external CERTIFICATE_BUNDLE are reported as fail with remediation guidance, since their signature algorithm cannot be inspected from the IAM Roles Anywhere API alone. Severity: low.

Important

Depends on #11318 (acmpca service). The check imports acmpca_client to resolve the backing CA's key algorithm, so this PR is stacked on feat/acmpca-certificate-authority-pqc-key-algorithm and should be merged after #11318. GitHub will retarget this PR's base to master automatically once #11318 is merged.

Steps to review

1. New service: prowler/providers/aws/services/rolesanywhere/ (rolesanywhere_service.py, rolesanywhere_client.py)
2. Check implementation: prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/
3. Run the tests: poetry run pytest tests/providers/aws/services/rolesanywhere/ -v
4. Optionally run against a real environment: prowler aws --check rolesanywhere_trust_anchor_pqc_pki

Checklist

Community Checklist

• This feature/issue is listed in here or roadmap.prowler.com
• Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

• Review if the code is being covered by tests.
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.
• Review if is needed to change the Readme.md
• Ensure new entries are added to CHANGELOG.md, if applicable.

SDK/CLI

• Are there new checks included in this PR? Yes
  • Yes, permissions updated: adds rolesanywhere:ListTrustAnchors to both permissions/prowler-additions-policy.json and the CloudFormation scan-role template.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.