cw-log-retention-guard — stop CloudWatch logs from hoarding storage forever

CloudWatch Log Groups never expire by default — audit and enforce a retention baseline before the storage bill does it for you.