[Enhancement] Expand AWS Config NIST mapping coverage & re-baseline to 800-53 Rev 5

[clem-field]

Background

Follow-up to #8458 (fixed by #8459), which addressed collapsed NIST sub-parts. Separately, the AWS Config mapping is stale and incomplete:

• libs/hdf-converters/src/mappings/AwsConfigMappingData.ts maps 106 Config rules, all NIST 800-53 Rev 4.
• AWS currently publishes ~822 managed Config rules (list) → ~716 unmapped. (Some AWS rules are pure tagging/description checks with no meaningful control mapping, so 716 is an upper bound on the real gap.)
• All 106 rules we do map still exist in AWS's catalog — the subset is valid, just small and revision-dated.

This is a compliance-coverage problem: rules that could carry NIST tags simply don't, so 800-53 rollups under-report.

Proposed work

1. Re-baseline to Rev 5 (current 800-53 baseline; Rev 4 is withdrawn), keeping Rev-4 data available for consumers that request it (revision-aware lookup).
2. Expand coverage toward the applicable subset of the current AWS managed-rule catalog.
3. Ready-made source: mitre/hdf-libs (hdf-mappings/go/awsconfig/awsconfig-mappings.json) already carries 127 separately-authored, uncollapsed Rev-5 rows alongside the identical Rev-4 set. Those are a concrete starting point to port from (note they are a Rev4→Rev5 re-map, not a mechanical expansion of the Rev-4 tags).

Related

• [BUG] AWS Config mapper collapses NIST control sub-parts into one tag — all but the first become unreachable #8458 / fix(hdf-converters): expand collapsed AWS Config NIST sub-parts (#8458) #8459 (collapsed sub-parts)
• Companion completeness issue on hdf-libs: [Enhancement] Expand AWS Config NIST mapping coverage toward the current managed-rule catalog hdf-libs#164