Enhance AES check with export history and passphrase warning

[monrog2]

The Global AES Encryption check now reports the latest successful configuration export's policy, completion time, and age, and warns customers that the original AES passphrase must be retained to restore encrypted exports. These details appear in console and APIC JSON output, including for passing results.

Export history is read from the first successful configJob ordered by lastStepTime descending. Missing history or query failures are informational and do not change the AES result. The check does not trigger or collect an export or verify customer knowledge of the passphrase.

Also fixes the mandatory-encryption boundary to include target version 6.1(2a). Missing encryption objects require manual confirmation; missing or unexpected encryption attributes report an error. Documentation and unit tests cover these behaviors.

Closes #479.

Validation: 58 targeted unit tests passed:

python3 -m pytest tests/checks/aes_encryption_check/test_aes_encryption_check.py tests/checks/test_result_details.py tests/test_icurl.py tests/test_AciResult.py -q -o log_cli=false

git diff --check passed. The read-only export query was verified against the live APIC MCP; the updated script has not been run in live integration tests.