Set up security scanning of infrastructure

[afeld]

We want to ensure we don't have any misconfiguration that could leave us open to attacks.

Acceptance Criteria

• [ ] The engineering team is notified of any misconfiguration of infrastructure

Additional context

There are a couple possible approaches to this:

• Scan the live infrastructure
  • Microsoft Defender for Cloud
  • (there are other third-party options)
• Static analysis of the Terraform configuration
  • Checkov
  • Snyk
  • Terrascan

[thekaveman]

Related: #306

[angela-tran]

This feels shaped enough, just not sure if we need to do it soon