tfsec-baseline — a checkov baseline that runs clean and won't rot

An opinionated checkov baseline for Terraform: clean on well-formed modules, custom tag/encryption rules, and suppressions that carry an owner and an expiry.