By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

Fixes #7006

Although the issue reported in #7006 doesn't cause a /crash/ per se, checkov was failing to process the file() expansion on the resources SequenceNode; thus not scanning the file at all.

The serverless parser expands file() expansions by way of yaml.safe_load which is fine for scalar values, but for SequenceNodes of resources, this needs to be handled in cfn_yaml otherwise the resources don't get added to
the graph (they lack the marking attributes, and so the graph creation fails.)

This PR also adds a 'file' attribute to the yaml nodes for use in diagnostics, extends the serverless runner to use it, and enriches yaml parse error handling, adding a logging.error() tell with specifics. I've also replaced the IOError exceptions groked by errno with thier more descriptive equivalents in the serverless and cfn parsers.

Additional tests have been added to test that the file() expansion handling works as it should, and that a check passes when run on yaml containing an expansion; and that an CfnParseError gets raised on attempts at circular inclusions.

For the yaml provided in #7006, after correcting a syntax error in the yaml itself, I get the following results with these changes applied:

serverless scan results:

Passed checks: 4, Failed checks: 0, Skipped checks: 0

Check: CKV_AWS_364: "Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount"
        PASSED for resource: AWS::Lambda::Permission.CustomFunctionInvokePermission
        File: /serverless.yml:4-9
        Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-364
Check: CKV_AWS_41: "Ensure no hard coded AWS access key and secret key exists in provider"
        PASSED for resource: Alerts
        File: /Alerts.yml:1-10
        Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/secrets-policies/bc-aws-secrets-5
Check: CKV_AWS_1: "Ensure IAM policies that allow full "*-*" administrative privileges are not created"
        PASSED for resource: Alerts
        File: /Alerts.yml:1-10
        Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/iam-23
Check: CKV_AWS_49: "Ensure no IAM policies documents allow "*" as a statement's actions"
        PASSED for resource: Alerts
        File: /Alerts.yml:1-10
        Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-iam-policies/bc-aws-iam-43

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes