feature(deadline): Enable logging for DocDB

[kozlove-aws]

This fix DocDB part of the issue discovered during the security audit

Was added class that can be used if customer want to switch audit log.

Description of how audit log can be enabled is here

In repository constructor was added databaseAuditLogging parameter and according to value of this parameter enable audit logging for DocDB cluster.

Also was added example code in kitchen sink.

Was enabled parameter audit_logs and added audit to enableCloudwatchLogsExports construct option.

Testing

Was deployed kitchen sink with this changes and checked that CloudWatch logs enabled

Checking CloudWatch that audit log group was created and messages appeared.

[ddneilson]

We use CDK construct for DocumentDB so we only can fix it in our example.

I do not believe this statement. Anything that can be done in the application code can be done in the Repository. The ask, for the Repository, is to design an interface (similar to what Dave did for the ALB) that allows a customer to tell the Repository to enable audit logging when/if the Repository creates a DocDB database for the customer (i.e. if it's not being provided one).

Especially since the thinking is to remove the kitchen sink example from the repo once we have a solid set of official samples in place.

[jericht]

Ideally we should upstream these changes to the DatabaseCluster class in CDK so we can simply add a new property for the audit logging stuff (e.g. auditLogging?: AuditLoggingProps). If we are short on time though, this will have to do for now. Thoughts @ddneilson ?

[jericht]

Just the comment on the parameter group descriptions then this looks good to me.

[jericht]

Looks good!

[grbartel]

I have 2 more comments for this one:

1. The merge request title needs to be updated since you are adding a feature to the Repository not adding to the example
2. This MR requires Tests for the new functionality that was added to the Repository.

[grbartel]

This test title is kind of awkward. Can we instead have it be something along the lines of

Disabling Audit logging removes parameters

[kozlove-aws]

It is not actually remove parameters, it switching audit log off.
What about Disabling Audit logging does not enable audit logging?

[grbartel]

Compared to the default it is removing the parameters to switch of auditing.

But sure your naming should work.