docs: add inspect.software health badge

[Nayjest]

This PR adds the inspect.software health badge to the README.

Why this PR?
Your project ranks in the upper rating bands of our open-source health index (which measures maintainability, responsiveness, and security). This badge makes that standing objectively visible to your users. Our index is a free public good, and scores cannot be bought.

Technical details:

• No tracking: Static SVG served via GitHub's CDN. No JavaScript, no third-party tracking.
• No maintenance: The badge updates automatically after every inspection.
• Transparent: Links directly to your full report, based on our open methodology.

If you prefer to keep your README minimal, feel free to close this PR without replying. Your report will remain publicly available and up-to-date either way.

[aws-sam-tooling-bot]

Code Review Results

Reviewed: 5b6ebdb..d544fe0
Files: 1
Comments: 1

[aws-sam-tooling-bot]

[GENERAL] This badge embeds an image whose content is fully controlled by an unaffiliated third party, at a mutable location:

[![inspect.software](https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/aws/aws-sam-cli.svg)](https://inspect.software/software/aws/aws-sam-cli)

Two concrete concerns for a repository published under the aws org:

1. Unreviewed mutable content in the project's most visible document. The asset is pinned to main of inspect-software/badges, so whoever controls that repository can change what the AWS SAM CLI README displays at any time — a different score, different wording, or arbitrary imagery — with no PR, no commit here, and no notification. GitHub's camo proxy prevents scripting inside the SVG, so this is not an XSS vector, but it does mean the rendered claim is not under this project's control. The existing badges differ here: shields.io ones are generated from parameters in the URL itself (license, release, static text), so their content is determined by this file rather than by a third party's branch state.

2. The badge asserts a third-party quality/security rating on behalf of the project. Unlike the current badges (license, version, install channels), which state verifiable facts, this one publishes an external "health/maintainability/security" score. Endorsing a vendor's rating methodology in the official README is a project-governance and brand decision for the SAM CLI maintainers, not a documentation tweak — and the PR description itself is unsolicited vendor outreach.

If maintainers do want the badge, pinning the image to an immutable ref (a commit SHA rather than main) would at least make the displayed content deterministic and require a PR to change.

I could not verify the availability or contents of the badge URL or the linked report, since this review does not make network requests; the concerns above are about the referencing pattern, not about whether the resources currently exist.

No other files were changed; the diff is a single one-line addition, and there are no code, dependency, or configuration changes to review.