Update terraform to add WIZ sensor.

[cduhn17]

🗣 Description

The change updates each task definition to add the Wiz sensor sidecar container, mount it into the main application container(at prod and staging) is testing automation rather than a production runtime workload. Additionally, the changes made in this PR are modifying the Terrafrom dedupe sort script to skip over CLI argument order. The current state CLI arguments are being alphabetized on pre-commit, resulting in task definitions failing.

💭 Motivation and context

This change is required so Wiz Runtime Sensor installation is managed through Terraform instead of manual ECS task definition edits. The environment is redeployed through Terraform as part of normal code deployment, so manually patched ECS task definitions would be overwritten or drift from source control.
By encoding the Wiz sensor setup in Terraform, new ECS task definition revisions consistently include the sensor with no post-deploy manual steps. This supports the ticket acceptance criteria to review Wiz installation documentation, add the sensor to the necessary Terraform-managed platforms, and verify the sensors through the Wiz Console.
The implementation follows Wiz’s ECS/Fargate init-container documentation by adding the sensor sidecar, volumesFrom, dependsOn, SYS_PTRACE, the sensor entrypoint wrapper, and Secrets Manager-backed Wiz credentials.

SPECIAL NOTE regarding PRE-COMMIT failures

The Terraform pre-commit hook currently alphabetizes every JSON heredoc list of strings. That breaks ECS entryPoint arrays because order is semantic: the first element is the executable and the remaining elements are arguments. Wiz’s documentation requires ["/opt/wiz/sensor/wiz-sensor", "daemon", "--"]; sorting changes it to ["--", "/opt/wiz/sensor/wiz-sensor", "daemon"], causing ECS to try to execute --. The hook should skip ordered ECS command fields such as entryPoint and command. We will in the future have to modify our pre-commit to omit this check on the list of string at the ECS entryPoint noted above.

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All future TODOs are captured in issues, which are referenced in code comments.
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated to reflect the changes in this PR.
• Tests have been added and/or modified to cover the changes in this PR.
• All new and existing tests pass.
• Bump major, minor, patch, pre-release, and/or build versions as appropriate via the bump_version script if this repository is versioned and the changes in this PR warrant a version bump.
• Create a pre-release (necessary if and only if the pre-release version was bumped).

✅ Pre-merge checklist

• Revert dependencies to default branches.

✅ Post-merge checklist

• Create a release (necessary if and only if the version was bumped).

[cduhn17]

See the SPECIAL note in the PR writeup, to explain the pre-commit issue.

[aloftus23]

See issue with variables and suggested options.

[aloftus23]

looks good

[nickviola]

LGTM