Address code review findings:
- Restrict URL validation to sns.<region>.amazonaws.com only
(prevents attacker-controlled S3 buckets from being accepted)
- Add support for SignatureVersion 2 (SHA256withRSA)
- Fix resource leak by wrapping certificate stream in with-open
- Return proper HTTP status codes (4xx for invalid messages,
5xx for transient failures)
- Add comprehensive tests for URL validation, signature versions,
and HTTP response codes
Closes#11092
AI-assisted-by: qwen3.7-plus
2101d657e5