Fix the compliance audit of an RDS database

An assistant's Terraform for a customer database left encryption off, put the password in the file and made the database public. Compliance review is in 2 days, so the team now audits every aws_db_instance from its attributes.

An assistant wrote audit_db_instance(attributes). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• attributes: the resource's settings, one string per line, each meant to be key=value. The list can be empty.
• Return the findings as a list of strings, sorted in ascending order. Each finding appears at most once. No findings returns an empty list.

Rules the tests check:

• Split each line at its first =, so a value can hold more = signs. Ignore a line with no =. Keys are case sensitive, and unknown keys are ignored. When a key repeats, the last line wins.
• A setting is true only when its value is exactly true. True, yes and an empty value are not true.
• "encryption_at_rest_off": storage_encrypted is not true. A missing storage_encrypted counts, because AWS leaves storage unencrypted by default.
• "hardcoded_password": password is present, not empty, and does not start with one of var., local., data. or random_password.. Those prefixes mean the value is a reference to a secret kept elsewhere. Anything else is a literal password that lands in the state file and the repo. The prefix check is case sensitive.
• "public_endpoint": publicly_accessible is true.
• "no_final_snapshot": skip_final_snapshot is true.
• "deletion_protection_off": deletion_protection is not true. A missing deletion_protection counts.