s3-public-audit — catch publicly exposed S3 buckets and get a fix plan

Catch publicly exposed S3 buckets and get a concrete fix plan: evaluate ACLs, bucket policy and Block Public Access together, classify each bucket, and explain which setting is responsible.