feat: Add observability IAM permissions for RIG cluster execution role

[Madhubalasri-B]

Summary

When observability is enabled on RIG (Restricted Instance Group) clusters, attach APS RemoteWrite and CloudWatch Logs permissions to the cluster execution role.

Changes

• main.tf: Allow observability module for RIG clusters; pass rig_mode and execution_role_name to the observability module
• modules/observability/variables.tf: Add rig_mode (bool) and execution_role_name (string) variables
• modules/observability/iam_roles.tf: Add execution_role_observability inline policy with aps:RemoteWrite and CloudWatch Logs permissions, conditional on rig_mode
• rig_custom.tfvars: Enable observability module (create_observability_module = true)

Testing

• Deployed full RIG HyperPod EKS cluster via terraform apply with rig_custom.tfvars
• Verified the inline policy was created on the execution role with correct APS and CloudWatch Logs permissions
• terraform validate passes

[apsknight]

LGTM

[bluecrayon52]

In main.tf you can remove the local.create_observability_module and replace with a direct reference to var.create_observability_module since we are no longer automatically disabling this feature based on the state of local.rig_mode.

Please also update the README.md to reflect changes, specifically the section that calls out the HyperPod Observability module as not supported by RIGs, and specify which Advanced Observability Metrics Configurations are supported with RIGs.