chore(providers/aws): 4 AWS service-client funcs exceed pre-commit gocyclo -over 10 (keeps pre-commit CI red) #1388

Summary

The gocyclo pre-commit hook (.pre-commit-config.yaml, gocyclo -over 10) runs --all-files in the pre-commit CI workflow, so it evaluates the whole repo on every PR. Four pre-existing AWS service-client functions sit at cyclomatic complexity 11, above the hook's threshold of 10, which keeps the pre-commit CI job red on every PR regardless of what the PR changes.

Offending functions (all complexity 11)

• providers/aws/services/redshift/client.go:414 — (*Client).findOfferingID
• providers/aws/services/opensearch/client.go:369 — (*Client).findOfferingID
• providers/aws/services/memorydb/client.go:285 — (*Client).findOfferingID
• providers/aws/services/elasticache/client.go:288 — (*Client).paginateElastiCacheOfferings

Why this isn't covered by existing lint-debt issues

golangci-lint also runs gocyclo, but its threshold is min-complexity: 15 (.golangci.yml), so the Lint Code job and the golangci burn-down (#1342) do not flag these functions. They are only caught by the stricter pre-commit hook (-over 10). No existing issue tracks this threshold gap.

Suggested fix (either is acceptable)

1. Refactor the four functions under complexity 10 (extract the offering-match / pagination inner loops into helpers — these clients already share a copy-pasted skeleton, see ARCH-03: AWS RI purchase skeleton (idempotency guard etc.) copy-pasted across 5-6 service clients cloud-commitments-go#10), or
2. Align the pre-commit gocyclo -over threshold with golangci's min-complexity (15) so the two gates agree, if 15 is the intended project standard.

Option 1 is preferred (lower complexity is the real goal); option 2 is a config-only stopgap.

Context

Surfaced by the pre-commit CI job on PR #1376 (the new per-package gosec hook). #1376 does not touch any Go code — this is pre-existing repo-wide debt caught by the --all-files run.