feat: add new query types - DescribeRouteTables/DescribeSubnets/DescribeSecurityGroupRules - #11

@ytsarev, thanks for the review. All three blockers were real and are fixed; replies inline on each thread.

On the design question: taken as proposed. DescribeEc2 + parameters.operation is gone, replaced by DescribeRouteTables / DescribeSubnets / DescribeSecurityGroupRules in the registry, CRD enum regenerated, and the runtime default: branch deleted outright.

Your argument is stronger than the schema-validation framing suggests, given this function returns a fatal result on any error: a typo like operation: routeTables did not degrade, it aborted the whole composition at reconcile. In the consumer's history one such mistake burned 27 minutes for zero resources. Enum validation moves that to admission time. It is an API change, which is exactly why it belongs here rather than after a release.

Checked c658ab1 out locally. go build ./..., go test ./... and golangci-lint run (v2.11.4) all clean, and CI is green.

All eight threads addressed, seven resolved. The design change went further than I suggested: folding the shared precondition into ec2Client with a per-operation hint means the error names the filters that operation accepts, rather than one generic list. Better than what I proposed.

Two things I checked specifically:

• No codegen drift. The enum in package/input/aws.fn.crossplane.io_inputs.yaml matches input.go exactly across all 11 values. Worth noting CI has no drift check, so this holds by discipline rather than enforcement. Might be worth a go generate diff step in a follow-up.
• Filter guard has real teeth. TestDescribeEc2FilterGuard asserts on message content rather than just err != nil, and covers all three query types.

I also liked the call on absent values: documenting the two policies and explaining why omitting beats faking is a better outcome than the shape change I was angling for.

Two cosmetic leftovers, neither blocking:

1. README.md:56, left in the open thread above.
2. Test names still say DescribeEc2 (aws_test.go:493 section header, plus TestDescribeEc2Dispatches, TestDescribeEc2FilterGuard, TestDescribeEc2RouteTablesPaginates, TestDescribeEc2RegionGuard, TestDescribeEc2Subnets, TestDescribeEc2SecurityGroupRules) for a query type that no longer exists.

Nothing outstanding from my side beyond those.

Both cosmetic leftovers are fixed; replies on the two threads. grep -rn DescribeEc2 across the repo is now empty.

On the codegen drift check: confirmed independently, go generate ./input produces no diff. But it should not go in this repo. .github/workflows/ci.yml here is synced from upbound/sa-up (see 737a83a), so a step added locally would be reverted on the next sync. It needs to land in the shared workflow template instead, where every function repo gets it rather than just this one. Happy to open that upstream.

Gates after the rename: go build, go vet, go test -race, gofmt, golangci-lint v2.8.0 all clean.