RFC: Add `pii-protection` skill

[joaovictortinoco]

Summary

Add a standalone pii-protection skill to aws-dev-toolkit for stopping PII leaks in
AWS at the infrastructure layer — no application code change required. It pairs
CloudWatch Logs Data Protection (real-time masking of sensitive fields in live logs)
with Amazon Macie (discovery of PII already at rest in S3), routing HIGH-severity
findings through Security Hub -> EventBridge -> SNS.

Motivation

The existing security skills (security-review, iam, hipaa-assistant,
well-architected) cover IAM, IaC scanning, and compliance frameworks, but none
address runtime data-protection: masking sensitive data already flowing into logs, or
discovering undiscovered PII sitting in storage. A leftover debug line like
logger.info(json.dumps(event)) leaks national IDs, card numbers, emails, and phone
numbers into CloudWatch Logs forever — and founders under LGPD/GDPR/CCPA need a fix
they can ship in minutes, not a code refactor sprint.

Proposed Solution

• New folder: solution-architecture/plugins/aws-dev-toolkit/skills/pii-protection/
• Single flat SKILL.md in dev-toolkit style (two-layer approach -> process ->
  gotchas -> output table). No references/ folder to start.
• Opinionated stance: protect at the infra layer first, refactor code later.
• Two layers: CloudWatch Logs Data Protection (live logs) + Amazon Macie (data at
  rest in S3), with HIGH findings wired to Security Hub -> EventBridge -> SNS.
• Gotchas drawn from a real POC: region support for country-specific identifiers,
  Macie's 2-10 min finding lag, cdk destroy not disabling Macie (ongoing billing),
  Macie per-GB cost, and logs:Unmask as the audit escape hatch.
• Cross-link with security-review, s3, observability.

Alternatives Considered

• Fold into security-review — rejected: that skill is a static IaC/config audit
  checklist; runtime data masking and storage discovery are a different workflow.
• Name it macie or data-protection — rejected: no skill is named after a single
  service, and pii-protection names the outcome the founder wants.

Open Questions

• Name pii-protection vs data-protection?
• Keep it flat, or add a references/ deep-dive on the two-layer CDK wiring?

Drawbacks

• Adds to skill count. Managed data identifiers and Macie regional support change over
  time and will need periodic refresh.