fix(cli): gen2-migration inject required standard attrs into social IdP mappings

[sharonyajain]

Description of changes

When gen2-migration generate migrates a Gen1 app whose Cognito user pool has phone_number as a username attribute and also uses social sign-in (Google/Facebook), the generated Gen2 app fails to deploy:

CREATE_FAILED | AWS::Cognito::UserPoolIdentityProvider | auth/amplifyAuth/GoogleIdP
  Resource handler returned message: "The attribute mapping is missing required attributes [phone_number]"

Cognito treats a username attribute as implicitly required, and then requires every federated identity provider's attributeMapping to include that attribute. The migration renderer copies phone_number forward as a username attribute but generates the social IdP attributeMapping from the Gen1 provider metadata only (which typically maps just email + a custom username claim), so phone_number is absent and CloudFormation rolls the auth nested stack back. This surfaced as the l_gen2_migration_media_vault E2E shard failing on every deploy retry.

Approach → change: the auth renderer now derives the pool's required standard attributes (UsernameAttributes ∪ AliasAttributes, filtered to standard attributes it knows how to map via MAPPED_USER_ATTRIBUTE_NAME) and injects each into every social provider's attributeMapping as an identity mapping (e.g. phoneNumber: 'phone_number') only when the Gen1 metadata did not already provide one. This is a general rule derived from the pool config, applied to all providers — not a per-app or per-provider special case. It preserves Gen1 login behavior (phone_number stays a username attribute) and removes no capability; it only adds the mapping Cognito already requires.

This is independent of the store-locator circular-dependency fix in #14981 — it is a separate, pre-existing migration-codegen gap for the required-standard-attribute + social-IdP combination.

no linked issue: surfaced via the media-vault E2E shard, not a filed GitHub issue

Issue #, if available

N/A

Description of how you validated changes

• Added a regression test (auth.generator.test.ts) that generates from a pool with UsernameAttributes: ['email', 'phone_number'] + Google/Facebook IdPs mapping only email; it asserts phoneNumber: 'phone_number' is injected into both provider mappings, the Gen1 custom username claims are preserved, and phone_number remains a pool username attribute. Verified the test fails without the fix (Expected 2, Received 0) and passes with it.
• Full gen2-migration/generate suite green: 23 suites / 260 tests / 103 snapshots, including the gated media-vault snapshot comparison (regenerated _snapshot.post.generate/amplify/auth/resource.ts).
• tsc --noEmit clean, prettier clean, eslint 0 errors.

Checklist

• PR description included
• yarn test passes
• Tests are changed or added
• Relevant documentation is changed or added (and PR referenced)
• New AWS SDK calls or CloudFormation actions have been added to relevant test and service IAM policies
• Pull request labels are added

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.