fix: Fix malware protection plan role ARN reference

[HubertPiotrowski]

Description

Fixes the aws_guardduty_malware_protection_plan resource role assignment which was passing the entire resource object instead of the ARN string.

Changes

1. main.tf:135 - Added [0].arn to properly extract ARN from count-based IAM resources
2. data.tf:6 - Fixed inverted count logic: data source should exist when NOT creating the role (i.e., looking up existing service-linked role)

Error Before Fix

Error: Inconsistent conditional result types

on main.tf line 135:
  role = var.create_malware_protection_role ? aws_iam_service_linked_role.malware_protection : data.aws_iam_role.malware_protection

The true and false result expressions must have consistent types.

Testing

• Terraform validate passes
• The role argument expects an ARN string, not a resource object