Remove SAM translator dependency, validate SAM templates via schemas

[kddejong]

Summary

Replace the aws-sam-translator runtime dependency with direct JSON Schema validation of SAM resource types. SAM templates are now validated against schemas from the enhanced schemas service, using the same provider schema infrastructure as CloudFormation resources.

Changes

• Remove _sam.py transform module and aws-sam-translator dependency
• Add _sam_globals.py to merge Globals section properties into SAM resources
• E3724: Validates Globals section structure against the SAM Globals schema
• E3066: Validates that Connectors and IgnoreGlobals require the SAM transform
• Lambda rule keywords: Extended Lambda rules (E2531, E2533, etc.) to also match AWS::Serverless::Function paths
• Sub-resource wildcard: SAM resources use the same module wildcard mechanism for Ref/GetAtt
• Implicit resource injection: SAM-generated resources (roles, versions, aliases, stages, permissions, etc.) are injected for validation
• GetAtt resilience: Handle unresolvable schema pointers gracefully instead of crashing

Behavioral Notes

• Input validation: SAM resource properties, Globals, events, and policies are validated against SAM schemas from the enhanced schemas service
• Output validation: We no longer validate the transformed CFN output (generated IAM roles, API Gateway stages, etc.). SAM owns that correctness
• Sub-resources: !Ref MyFunctionRole and !GetAtt MyFunction.Arn pass via the wildcard mechanism

Testing

• Unit tests for globals merging, implicit resource injection, and new rules
• Integration tests for good/bad SAM templates, IgnoreGlobals interaction
• All existing integration tests pass
• Verified no false positives on real-world SAM templates

Fixes #4556

[codecov]

Codecov Report

❌ Patch coverage is 98.85714% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.44%. Comparing base (5faa41e) to head (6409d21).

Files with missing lines	Patch %	Lines
src/cfnlint/rules/functions/GetAtt.py	60.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4491      +/-   ##
==========================================
- Coverage   94.48%   94.44%   -0.04%     
==========================================
  Files         430      432       +2     
  Lines       15190    15214      +24     
  Branches     2921     2929       +8     
==========================================
+ Hits        14352    14369      +17     
- Misses        459      463       +4     
- Partials      379      382       +3     

Flag	Coverage Δ
unittests	94.44% <98.85%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[paul-uz]

@kddejong I think this has broken something. 1.54.0 now reports E3001 Additional properties are not allowed ('Description' was unexpected) when an AWS::Serverless::Function resource has a Description. 1.53.0 did not have this issue.

[kddejong]

@paul-uz Thanks for reporting this. I've tracked it in #4606.

The issue is that Description is at the resource level (sibling of Type/Properties) rather than inside Properties. While this template does deploy successfully, the SAM transform silently drops the Description — your Lambda function ends up with an empty description.

Workaround: Move Description inside Properties:

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Description: "Your description here"  # ✅ Correct location
      Runtime: python3.12
      ...

cfn-lint 1.54 is flagging this as an error, but since the template does technically deploy (just with the field silently ignored), we'll look at downgrading this to a warning for SAM resources.