Add iac/ folder validation for JSON patches and linked base templates

[bhapas]

What does this PR do?

Adds an optional iac/ folder to integration and input packages, and iac_blueprints manifest fields so packages can declare RFC 6902 JSON Patch contributions against a versioned blueprint id.

This does not introduce a new type: blueprint package. Canonical blueprints live in the integrations repo root. Integration and input packages ship:

• RFC 6902 JSON Patch files (*.patches.json) in iac/
• Linked or inlined base templates (*.cloudformation.json / *.arm.json), with allowLink: true so elastic-package .link files can point at a shared template

Blueprint ids are versioned: <provider>/<trust-model>/<scope>/v<n> (for example aws/federated-identity/account/v1).

Why is it important?

Packages need a spec-backed way to contribute IaC patches on top of shared base templates without a separate blueprint package type. Validating patch documents and linked templates in package-spec keeps invalid ops, missing required fields, unknown iac/ files, and unversioned blueprint ids from landing in packages.

Checklist

• I have added test packages to test/packages that prove my change is effective.
• I have added an entry in spec/changelog.yml.

Related issues

• Relates to Support dynamic IaC for integrations #1209 (does not replace or modify it; that PR added a spec/blueprint/ package type, which this work moves away from)
• Relates to integrations POC [DRAFT] POC: share canonical blueprint via .link files from repo root integrations#20721
• Companion package-registry: Expose package iac/ folder and iac_blueprints in EPR package-registry#1940
• Companion integrations: Add versioned root IaC blueprints and per-package iac patches/links integrations#20728

[infra-vault-gh-plugin-prod]

💔 Build Failed

• Buildkite Build
• Commit: bb759e3

Failed CI Steps

• :go: Run check-static

History