[semx]

Adds a read-only AWS source, supersedes #603 (stalled on a fork branch with a broken circular self-import and a never-committed AWSClient).

What this adds

• EC2 instance / EBS volume / ENI discovery, synced into VM/Cluster/VirtualDisk objects with VPC-scoped VRF and IP import.
• Explicit region list or regions = auto discovery.
• Single account or AWS Organizations scanning (per-account role assumption, allowlist, external ID, management-account opt-in).
• Optional S3, Lambda, and EKS inventory (off by default, opt-in per service).
• Authorization-denial handling: a denied call for one account/region/service/resource is tolerated, logged, and reconciled into a Sync:AccessDenied:<Operation> NetBox tag, instead of aborting the whole run or pruning objects the source just couldn't see this time.
• Name-collision handling: a conflicting NetBox object is skipped with a log line and its existing children are retained, rather than aborting the run.
• docs/source_aws.md with required read-only IAM permissions, Organizations setup, and the authorization-denial contract.

Testing

• tests/test_aws_source.py + tests/test_aws_services.py, ~190 cases against botocore.stub.Stubber (pagination, access-denied semantics, Organizations, S3/Lambda/EKS, name collisions) — no AWS credentials needed.
• Full suite green on top of current development.
• Verified read-only against a real AWS account (identity + EC2/S3/Lambda/EKS discovery, zero write calls, no credential/secret leakage in logs or NetBox data).

Closes #603.

[ekrichbaum]

This was a materially different set of client.py and connection.py items. there are some helpers and other items here but a lot of my protections and adjustments were removed from client.py. connection.py seems more limited with a catch around a ValueError, but again changed the collision logging and other elements. It will take some time to evaluate and compare items for the real world. It would have been preferable to note on the first PR those adjustments or needs prior to this point.