feat(prowler): chunk14 add the CIS benchmark contract (#422)

[Christophe Melchior (Kakudou)]

Part of #422.

Chunk 14 of the Prowler injector stack: add the CIS benchmark contract — the CHK.014 CIS benchmark assessment: the BDD suite (behaviour, OCSF status / lifecycle logs / verbose diagnostics / OCSF capture fixtures), the new contracts/cis.py defining the four canonical routes cis/aws, cis/azure, cis/gcp, cis/kubernetes against the Prowler 5.36 CIS benchmarks (cis_3.0_aws, cis_3.0_azure, cis_3.0_gcp, cis_1.12_kubernetes), the compliance-validation isolation in _core/prowler_client/client.py (compliance selectors that target another provider's benchmark are rejected before credential materialization), their registration in the registry / __init__, and the cross-chunk registry-alignment BDD updates (chk001, chk007, chk008, chk009, chk010, chk011, chk012, chk013) plus the chk006 unit registry expectations. Existing check and service selection channels are untouched.

Re-landed from feat/422-prowler-chk014-compliance-cis-benchmark (888d5a3..c75f7a9): 12 source commits folded into 5 (O1: b0c2668; O2: 6af19d4 + 4c7f295 + 12b3714 + 063e5fd; O3: a3591b1 + 80d8baa + c75f7a9; O4: f2a869f; O5: 0d491c3). O2 landed at the source-final post-image of the CHK.014 BDD suite, so the three later alignment commits folded in as content with zero conflicts, and the later layers' BDD/client.py post-images were no-ops wherever already carried. The planned sixth layer (style: 8a4bf8a + 719efb4, a re-titled formatting/lint pass over client.py and the BDD) was empty under the final-postimage rule — its format and lint content is already fully contained in O2's final BDD and O3's final client.py — and was dropped by call, so the fold lands as 12 → 5. Gate V (whole-branch tree vs source tip c75f7a9): byte-identical except (a) the 14 pyproject.toml version differences of the other injectors (source base 3.260805.0 vs re-land base 3.260821.0; prowler/ subtree untouched), (b) the 11 trap-analysis.md files (chk004–chk014) excluded by standing call, and (c) one approved deviation — the pinned pyoaev version assert removed from prowler/tests/unit/chk006_executable_base/test_outputs_registry_runtime.py.