Multiple fixes for "ghost" diffs

[dilchenko]

While current apply claims to finish successfully, if launched subsequently, terraform will claim to detect drift and require another apply - in a never ending loop. See https://app.terraform.io/app/Gravitational/workspaces/aws-terraform-infra-dev/runs/run-HX6y5y8tLT4zSiSZ for example.

This fixes some (hopefully, all) of the issues causing this:

• fixes the issue with launch templates metadata, aws_launch_template not configuring metadata_options  hashicorp/terraform-provider-aws#25909 (comment)
• fixes the issue with the ordering of acm cert validation records in the state aws_acm_certificate subject_alternative_names & domain_validation_options get returned in a different order each time hashicorp/terraform-provider-aws#8531 (comment)
• gets rid of the license file, as it is created anew on each terraform run in terraform cloud, which then triggers the update on the SSM parameter with license

Plan: https://app.terraform.io/app/Gravitational/workspaces/aws-terraform-infra-dev/runs/run-qQK4ZLDeR46zuBAg

[gozer]

Apart from the 2 small nits from @reedloden re: license_path and missing comment, this looks good and thank you for putting in effort to cleanup no-op plans 👏🏻

[dilchenko]

I added a comment to the variable. WRT license_path, it is still used as a parameter for the auth server ASG. I don't know yet if it can be removed safely, it will be determined and dealt with later.