feat: Add ALB+S3 hosting mode for private network/GovCloud deployments

- Add WebUIHosting parameter (CloudFront/ALB) to main template
- Add ALB hosting nested stack (VPC endpoint, security groups, target registration, listener rules)
- Add ELB access log permissions to logging bucket policy
- Make CloudFront resources conditional on UseCloudFrontHosting
- Make S3 website configuration conditional (disabled for ALB mode)
- Scope VPC endpoint policy to WebUI bucket only
- Update CORS origins, Cognito callbacks, CodeBuild env vars for ALB mode
- Add self-signed cert generation script for testing
- Register alb-hosting as build component in publish.py

Author: rcgeorge