Fix low-blast reasoner correctness bugs

[InfoSecHack]

Summary

• Add StringLike glob matching for iam:PassedToService in Lambda and ECS PassRole reasoners while preserving StringEquals exact matching and unsupported-operator UNKNOWN behavior.
• Filter cross-account trust SCP evaluation to parent constraints whose type is SCP.
• Demote S3 bucket takeover findings for dangling/uncollected bucket references to inconclusive/high and update S3 golden fixtures.

Validation

• python -m pytest -q tests/test_passrole_lambda_reasoner.py tests/test_passrole_ecs_reasoner.py tests/test_cross_account_reasoner.py tests/test_s3_bucket_takeover_reasoner.py: 132 passed
• ./scripts/check.sh: passed
• ./scripts/test_fast.sh: 1952 passed
• git diff --check: passed
• account/ARN scans: only pre-existing placeholder examples remain in source comments/help
• artifact scan: no matches