feat(dynamic-labels): add allow-list mode to the AWS dynamic labels policy

[atsikham]

Fixes #5412

Summary

aws_dynamic_labels_policy (the guardrail for ghr-ec2-* dynamic labels) only supports a blocklist: blocked_keys rejects specific keys, restricted_keys limits the values a specific key can have, and any key not on either list is allowed. This means a new EC2 override key GitHub adds later — or one that was simply left off the list — stays allowed until someone notices and blocks it. There was no way to set up a strict "nothing except these specific keys" policy without listing every single key to forbid.

Changes

• Adds allowed_keys?: string[] to AwsDynamicLabelsPolicy. When set (not empty), any key not on that list is rejected — deny by default instead of allow by default. When it's unset or empty, nothing changes from today.
• blocked_keys and restricted_keys keep working exactly as before, on their own.
• allowed_keys and blocked_keys mean opposite things, so only one should be used per policy at a time:
  • Terraform checks this and fails plan/apply if both are set — checked everywhere this policy can be configured: the root module's aws_dynamic_labels_policy, modules/webhook's runner_matcher_config (used when configuring the webhook module directly), and both the old and new shapes of modules/multi-runner's multi_runner_config.
  • If a policy with both somehow still reaches the code some other way (for example, a hand-edited SSM parameter), it rejects every dynamic label instead of guessing which list to use.
• Docs (docs/configuration.md) updated with an example for the allow-list next to the existing blocklist example, the new check order, and a note on why the allow-list closes a real gap the blocklist has — a blocklist can't protect against a future key that doesn't exist yet; an allow-list can.

Test plan

• yarn test — new cases in dynamic-labels-policy.test.ts: unset/empty allowed_keys changes nothing, a key outside a non-empty allowed_keys is rejected, allowed_keys works together with restricted_keys, and the reject-everything behavior when both allowed_keys/blocked_keys are set. Full compute-providers (308 tests) and webhook (83 tests) suites pass.
• yarn lint / yarn format / tsc --noEmit
• terraform fmt -check / terraform validate on the root module, modules/webhook (standalone), and modules/multi-runner (standalone)

[edersonbrilhante]

@atsikham The project requires signed your commits. Please sign so we can merge :)