feat(ssm): add association filter properties

[mike-rsi]

Summary

• Add filterable properties to SSMAssociation
• Fetch association tags so tag:<Key> filters work
• Expose association targets and target instance identifiers
• Add nil-safe handling, mock coverage, and generated property documentation

Motivation

SSMAssociation previously exposed only its identifier through String() and
did not implement Properties(). This prevented users from protecting an
individual association by name, document, target, or tag without excluding the
entire resource type.

Implementation

The resource now exposes:

• AssociationId
• AssociationName
• DocumentName
• InstanceId
• Targets
• TargetMaps
• Target:<Key> and TargetMap:<Key> properties
• TargetInstanceIds
• Resource tags as tag:<Key>

Tags are retrieved with ListTagsForResource using
ResourceType=Association.

If tag retrieval fails for an individual association, the lister logs a warning
and skips only that association. This avoids evaluating tag filters against
incomplete data without aborting discovery of every other association, following
the behavior discussed in #907.

Mock tests cover property extraction, tags, targets, target maps, pagination,
missing association names and IDs, missing tags, tag-retrieval failures, and
resource removal.

Validation

• go test -p 1 ./... -count=1
• go test -p 1 -timeout 60s -race -coverprofile=<temp-file> -covermode=atomic ./...
• go vet -p 1 ./...
• golangci-lint v2.11.4 for ./resources
• mkdocs build
• git diff --check

Closes #1014
Related to #907