chore: update c7n to 0.9.44, prep release 0.5.30 (ENG-5015) (#56)

* chore: update python version matrix and setup-python action

* chore: prep release 0.5.30

- Update to c7n-left 0.3.30
- Add dev dependencies for tomlkit and semver

* chore: use tomlkit in scripts/upgrade.py

tomllib is installed in Python 3.11+, but since we're
reading/writing/updating existing TOML files we need another package.
Python recommends TOML Kit for this sort of use case, and it works with
all Python versions we support.

See also: https://docs.python.org/3/library/tomllib.html

* add 3.11 back to test matrix

CI checks are stalled without it, and maybe it's better to leave anyway?

Also move from black/flake8 to ruff, to sync with some other repos and
avoid pre-commit failures on 3.13.

* nevermind, update flake8 instead

Moving to ruff makes formatting changes on 4 files. Not a huge deal, but
probably not a necessary switch for _this_ PR.

chore: pull in c7n-left 0.3.28, increment version (#52)

* add `removed` blocks to test modules

This breaks tests in c7n-left 0.3.27, but has no effect (as expected)
in 0.3.28.

* chore: bump c7n-left to 0.3.28

This brings in a number of upstream updates from tfparse & trivy,
notably the ability to properly evaluate Terraform modules that contain
a `removed` block.

* chore: bump version to 0.5.0

chore: bump to version 0.4.0 (#51)

Publish new version that captures CI context from the environment.

chore: update to latest sigstore action (#48)

The most recent run failed (https://github.com/stacklet/sinistral-cli/actions/runs/11036748647/job/30655998896), update to latest version.

fix: explicit pin of upstream c7n-left version (#44)

An upstream c7n release caused issues with sinistral-cli, so it was
determined that the default behavior should be to pin to the version
that we have specifically tested with.

fix: sinistral backend output doesn't override run cli output selecti…

…ons (#37)

chore: sinistral bump version and increment c7n-left dep (#29)