refactor(storage): extract webhook configuration stores

[edersonbrilhante]

Description

• add provider-neutral RunnerMatcherConfigStore and GitHubWebhookSecretStore capabilities selected through the existing runner-config storage provider
• move SSM matcher chunk loading, webhook-secret lookup, parameter paths, and backend error handling into the AWS SSM adapters
• update webhook configuration and tests to mock the storage abstractions without importing SSM
• remove the webhook package's direct aws-ssm-util dependency

This is a stacked PR based on #5277. It contains no Terraform or termination-watcher changes.

Test Plan

• full Lambda Vitest suite: 60 files, 908 tests
• storage-provider suite: 11 files, 92 tests
• webhook suite: 7 files, 84 tests
• TypeScript checks for storage-providers and webhook
• focused ESLint and Prettier checks
• yarn install --immutable
• production webhook NCC bundle
• git diff --check
• CodeGuard review for secret handling and log redaction

Related Issues

• Stacked on refactor(storage): extract runner configuration stores #5277

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

lambdas/functions/webhook/package.json

Package	Version	License	Issue Type
@aws-github-runner/storage-providers		Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/@aws-github-runner/storage-providers		Unknown	Unknown

Scanned Files

• lambdas/functions/webhook/package.json