Fix: allow sub-statements of IPSetReferenceStatements

[vboufleur]

Hi!

This PR is for allowing IPSetReferenceStatement.ARN entries which references a aws-firewall-factory controlled ipset (i.e. the name of the ipset) inside AND, OR and NOT statements (as sub-statements).

Before this PR, this policy would fail:

{
  "Name": "only-allow-the-good-guys",
  "Statement": {
    "AndStatement": {
      "Statements": [
        {
          "ByteMatchStatement": {
            "SearchString": "/good/guys/entrypoint",
            "FieldToMatch": {
              "UriPath": {}
            },
            "TextTransformations": [
              {
                "Priority": 0,
                "Type": "NONE"
              }
            ],
            "PositionalConstraint": "STARTS_WITH"
          }
        },
        {
          "NotStatement": {
            "Statement": {
              "IPSetReferenceStatement": {
                "ARN": "GoodGuysIPs"
              }
            }
          }
        }
      ]
    }
  },
  "Action": {
    "Block": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true
  }
}

Now its working ^^

[daknhh]

Thank you, we are currently working on the aws firewall factory 4.0 where we changed all configs to ts and also fix this bug

[daknhh]

Fixed here: https://github.com/globaldatanet/aws-firewall-factory/releases/tag/4.0.0 -> thank you <3