Add support for TLS 1.3 enhanced security policies in custom domains

Closes #13290

Problem

Users couldn't configure API Gateway custom domains with AWS's enhanced security policies like SecurityPolicy_TLS13_2025_EDGE. The framework only accepted legacy tls_1_0 and tls_1_2 values, throwing an error for any other input:

✖ Error: SecurityPolicy_TLS13_2025_EDGE is not a supported securityPolicy, use tls_1_0 or tls_1_2.

Solution

Modified the security policy validation to:

1. Pass through enhanced policies - Any value starting with SecurityPolicy_ is now passed directly to AWS API Gateway
2. Maintain backwards compatibility - Legacy shorthand values (tls_1_0, tls_1_2) continue to work
3. Remove invalid tls_1_3 - This was never a valid AWS value; TLS 1.3 is only available through SecurityPolicy_* policies
4. Improve error messaging - Now hints at enhanced policy usage when validation fails

AWS API Reference

Per AWS CreateDomainName API, valid securityPolicy values are:

• Legacy: TLS_1_0, TLS_1_2
• Enhanced: SecurityPolicy_TLS13_2025_EDGE, SecurityPolicy_TLS13_1_3_2025_09, SecurityPolicy_TLS12_PFS_2025_EDGE, etc.

Usage

  domains:
    - name: api.example.com
      securityPolicy: SecurityPolicy_TLS13_2025_EDGE  # Now works!

Changes

• lib/plugins/aws/domains/models/domain-config.js - Enhanced policy passthrough logic
• lib/plugins/aws/domains/globals.js - Removed invalid tls_1_3 entry
• test/unit/lib/plugins/aws/domains/models/domain-config.test.js - NEW - 11 unit tests

Summary by CodeRabbit

• New Features

  • Domains now support enhanced SecurityPolicy values to enable TLS 1.3 access.

• Improvements

  • Enhanced error messages for invalid security policies with clearer guidance on available options.

_{✏️ Tip: You can customize this high-level summary in your review settings.}