feat(kinesisfirehose): support HTTP endpoint destination

[Tietew]

Issue # (if applicable)

Closes #15502.
Closes #33585.

Reason for this change

Amazon Data Firehose delivery stream can deliver records to a custom HTTP endpoint destination.
Some destinations, e.g. Colalogix, Datadog, New Relic, etc., are based on HTTP endpoint destination.

See also:

• Configure destination settings for HTTP Endpoint
• Understand HTTP endpoint delivery request and response specifications
• Authenticate with AWS Secrets Manager in Amazon Data Firehose

Description of changes

Added the HttpEndpoint destination class.

Usage:

const httpDestination = new firehose.HttpEndpoint({
  // Endpoint configuration
  url: 'https://example.com/',
  name: 'MyEndpointName', // The endpoint name - optional
  // Authentication - optional
  accessKey: 'my-access-key', // Access key
  secretsManager: { secret }, // Secret from AWS Secrets Manager
  // Request configuration - optional
  parameters: {
    'eployment-context': 'pre-prod-gamma',
  },
  contentEncoding: firehose.ContentEncoding.GZIP,
  retryDuration: Duration.minutes(60),
  bufferingInterval: Duration.seconds(300),
  bufferingSize: Size.mebibytes(5),
  // Data Processor - optional
  processors: [lambdaProcessor], // In management console, only one lambda processor is allowed
  // Logging configuration - optional
  loggingConfig: new firehose.LoggingEnabled(),
  // S3 backup configuration - optional
  s3Backup: {
    mode: firehose.BackupMode.FAILED, // default - backup failed records
    mode: firehose.BackupMode.ALL, // backup all records
    bucket: backupBucket, // S3 backup bucket is automatically created by default
  },
});

Describe any new or updated permissions being added

The HTTP endpoint destination will grant following accesses to the destination role:

• Read access to the secret if present using secret.grantRead()
• Read/Write access to the backup bucket using bucket.grantReadWrite()
• Write access to the log group using logGroup.grantWrite()

Description of how you validated changes

Added unit tests and an Integ test.
The integ test also asserts the http endpoint is invoked correctly.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[Tietew]

Security Guardian detects the key policy of this KMS key.

{
  "Action": "kms:*",
  "Effect": "Allow",
  "Principal": "arn:${AWS::Partition}:iam::${AWS::AccountId}:root",
  "Resource": "*"
}