AWS redeploys send changes for values AWS reorders or normalizes #13497

Bug information

Steps to reproduce

1. Deploy a template with an AWS resource whose values AWS reorders or normalizes, for example an RDS DB instance:

   extension aws
   
   resource db 'AWS.RDS/DBInstance@default' = {
     alias: 'app-db'
     properties: {
       DBInstanceIdentifier: 'App-DB'
       Engine: 'mysql'
       EngineVersion: '8.4'
       // ...
       Tags: [
         { Key: 'team', Value: 'web' }
         { Key: 'env', Value: 'prod' }
       ]
     }
   }

2. Deploy the same template again, unchanged.

Observed behavior

The second deploy sends changes to AWS even though nothing changed. GeneratePatch (pkg/aws/operations) compares the template with what Cloud Control returns, item by item and as plain values. It reports a change when:

• An unordered array comes back in a different order. Tags, SubnetIds and other arrays the CloudFormation schema marks "insertionOrder": false (1,054 types have at least one) are compared position by position.
• AWS normalizes a value. The schema's propertyTransform describes these, and GeneratePatch ignores it. For example:
  • EngineVersion: '8.4' comes back as 8.4.11
  • DBInstanceIdentifier: 'App-DB' comes back as app-db
  • KmsKeyId comes back as a full ARN
• AWS reports an empty object. For example a log group's DataProtectionPolicy: {}. Flattening drops it, so every redeploy sends a remove.

Effects:

• RDS: sending EngineVersion: '8.4' again makes RDS upgrade the instance to the default minor version and reboot it right away, whenever the running minor is below that default.
• Create-only properties: a normalized value, such as a lowercased identifier, produces a change that Cloud Control rejects, so the redeploy fails.
• Every type: each unchanged redeploy calls UpdateResource for no reason.

Desired behavior

An unchanged redeploy sends nothing to AWS:

• Arrays marked "insertionOrder": false are compared ignoring order. If any item differs, the whole array is sent, as today.
• Before comparing, the schema's propertyTransform is applied to the template's value, and AWS's value is matched against the result. Support $lowercase, $uppercase, $join, $string and $OR. A property whose transform uses any other function is compared as it is.
• Empty objects that AWS reports are kept, unless the template sets values inside them.

Workaround

None. For RDS, set the full minor version, for example EngineVersion: '8.4.11'.