aws-vpc-endpoint-audit — find the VPC endpoints your NAT bill is paying for

Audits VPC endpoints against the traffic that is paying for NAT: missing S3 and DynamoDB gateway endpoints in VPCs that have a NAT gateway, gateway endpoints wired to only some private route tables, interface endpoints with private DNS disabled or no security group path on 443, single-AZ placement in a multi-AZ VPC, and wildcard endpoint policies. Prints the VPC, the endpoint and the fix, and exits non-zero in CI.