Resolve remaining Dependabot and code scanning alerts

[jmgasper]

What changed

• refresh the two nested Lambda dependency trees to remove the remaining Dependabot/Trivy vulnerabilities
• migrate the Udemy S3 helper to AWS SDK v3 and generate a Lambda-compatible Prisma 6.19.3 client during clean installs
• move the Mongo trigger to Node.js 24 and the Udemy loader to Node.js 22
• remove certificate image URLs and request errors from logs to close the CodeQL clear-text logging path
• harden the certificate image stack with KMS encryption, private S3 access through CloudFront OAC, public-access blocks, WAF, SQS encryption, and TLS 1.2 (2021)
• make both RDS instances private and encrypted, with snapshot retention policies

Why

The default branch currently reports 74 Dependabot alerts and 68 code-scanning alerts. The remaining findings come from stale nested lockfiles, a clear-text logging flow, and CloudFormation resources without the required encryption and public-access controls.

Validation

• workflow-equivalent Trivy 0.73 scan of tracked files: 0 critical/high/unknown findings
• npm audit: 0 vulnerabilities in both updated Lambda packages
• clean production installs and dependency-tree validation
• Serverless 3.40 packaging for both Lambda services
• packaged Udemy handler and Prisma RHEL/OpenSSL engine loaded in the official Lambda Node.js 22 image
• Mongo handler loaded in the official Lambda Node.js 24 image
• CloudFormation linting found no schema, reference, or dependency-cycle errors
• JavaScript syntax checks and git diff --check

Rollout notes

• Do not deploy the RDS template changes as a routine stack update. Enabling storage encryption requires replacement, and the fixed DB identifiers prevent CloudFormation from doing that in place. Coordinate encrypted snapshot restore, identifier cutover, and application validation first. The added snapshot policies preserve replaced/deleted instances but do not perform the migration.
• The existing certificate bucket moves from PublicRead to Private with public access blocked and CloudFront OAC enforced. It intentionally uses BucketOwnerPreferred for the first migration; switch to BucketOwnerEnforced after legacy ACLs are cleared.
• Serverless 3.40 warns about Node.js 22/24 because its validation schema is stale, but packaging succeeds and emits the requested runtimes. A deployment-tooling upgrade should follow.
• The certificate generator remains on Node.js 20 because its private Chromium layer needs to be rebuilt and canary-tested before a runtime upgrade. AWS currently schedules Node.js 20 function-update blocking for March 3, 2027.