Remove SAM translator dependency, validate SAM templates via schemas

[kddejong]

Summary

Replace the aws-sam-translator runtime dependency with direct JSON Schema validation of SAM resource types. SAM templates are now validated against schemas derived from the SAM project's own schema definitions, using the same provider schema infrastructure as CloudFormation resources.

Changes

• Schema generation (scripts/update_sam_schemas.py): Downloads the SAM JSON Schema, decomposes it into per-resource-type schemas, generates PassThrough property patches from CFN schemas, and updates provider modules with SAM type entries.
• Globals support (_sam_globals.py): Merges Globals section properties into SAM resources at validation time, respecting IgnoreGlobals.
• E3065: Validates that AWS::Serverless::Connector and IgnoreGlobals usage requires the SAM transform declaration.
• E3722: Validates Globals section structure against the SAM Globals schema.
• Lambda rule keywords: Extended Lambda rules (E2531, E2533, etc.) to also match AWS::Serverless::Function paths.
• Ref/GetAtt: SAM resources use the same sub-resource wildcard mechanism as Modules (via module_names). GetAtt on the SAM resource itself is validated against readOnlyProperties from the mapped CFN type.
• CFN mappings: All SAM types with CFN equivalents have primaryIdentifier and readOnlyProperties from their mapped type (e.g., Function → Lambda::Function, GraphQLApi → AppSync::GraphQLApi).
• Removed: aws-sam-translator dependency, _sam.py transform module, ManagedPolicies.json.

Behavioral Notes

• Input validation: SAM resource properties, Globals, events, and policies are validated against SAM schemas. This is equivalent to what the old translator checked.
• Output validation: We no longer validate the transformed CFN output (generated IAM roles, API Gateway stages, etc.). SAM owns that correctness.
• Sub-resources: !Ref MyFunctionRole and !GetAtt MyFunctionRole.Arn pass via the wildcard mechanism. Attribute validation is skipped for sub-resources (same as Modules).

Testing

• Unit tests for schema generation, globals merging, and new rules
• Integration tests for good/bad SAM templates, IgnoreGlobals interaction, and Module sub-resources
• All existing integration tests pass
• Verified no false positives on real-world SAM templates

Note

Commit message for 9d6ef6b incorrectly says E3064 — the actual rule ID is E3065 (E3064 is taken by VpcEndpointPrivateDnsDuplicate).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.55%. Comparing base (9bd40ec) to head (db70b67).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4491      +/-   ##
==========================================
- Coverage   93.57%   93.55%   -0.03%     
==========================================
  Files         466      468       +2     
  Lines       15230    15250      +20     
  Branches     2945     2953       +8     
==========================================
+ Hits        14252    14267      +15     
- Misses        599      601       +2     
- Partials      379      382       +3     

Flag	Coverage Δ
unittests	93.55% <100.00%> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.