detect-s3-cross-account-copy

Detect successful AWS S3 cross-account object copies from OCSF 1.8 API Activity records emitted by ingest-cloudtrail-ocsf. Emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1537 (Transfer Data to Cloud Account) when a principal from one AWS account performs a successful S3 `CopyObject` into a bucket owned by another account. Use when the user mentions "S3 cross-account copy", "cross-account CopyObject", "AWS exfil to another cloud account", or "T1537 via CloudTrail". Do NOT use as a generic S3 object-write detector, to infer every exfiltration path, or to claim all cross-account storage movement is covered.