Add checkov scanning, force IMDSv2, update resources to pass scans

[rtkmhart]

This PR adds checkov security scanning to the workflow, and update resources to pass the scans. Two resources change, with in-place updates:

• SSM parameter, change from String to SecureString
• enforce IMDSv2 on the NAT instances, which the code is already using (source)

There are two skipped checks:

• NAT instances have a public IP on purpose
• Launch template has an IAM instance profile attached, but checkov can't follow that logic

[RaJiska]

Thanks for the PR @rtkmhart, great addition. LGTM.

[lyuboraykov]

@rtkmhart thanks for implementing this! @RaJiska are you planning on making a release with the latest changes soon?