Add best practice guide: S3 bucket security

[protonese3]

Description

Add a best practice guide for securing AWS S3 buckets. This is one of the most common misconfigurations in cloud deployments.

What to add

Create knowledge/best-practices/s3-security.md and register it in src/tools/knowledge/best_practices.rs.

Topics to cover

• Block public access by default
• Bucket policies vs IAM policies
• Encryption at rest (SSE-S3 vs SSE-KMS)
• Presigned URLs for temporary access
• VPC endpoints for private access
• Logging with CloudTrail
• Common AI mistakes (public buckets, wildcard policies)

Follow the format of existing guides in knowledge/best-practices/.