Replace go-simple-asyncer with aws-sdk-go-v2 SQS

[oskarhurst]

Removes github.com/USACE/go-simple-asyncer, and with it aws-sdk-go v1, from both Go
modules.

Why this and not a version bump

CVE-2020-8911 and CVE-2020-8912 live in aws-sdk-go v1 and were never patched on the v1
line — the fix exists only in the v2 encryption client. So no bump closes them. The
dependency was never ours directly; it arrived through go-simple-asyncer, which pins
aws-sdk-go v1.35.7. Removing that library is the only thing that clears these.

What go-simple-asyncer was doing

It is a publish-side abstraction over SQS/SNS/Lambda/AMQP behind one interface:

type Asyncer interface {
    Name() string
    CallAsync(payload []byte) error
}

Cumulus used it in exactly two places, and they are very different:

Call site	Status
async_listener	live and load-bearing — Postgres NOTIFY on cumulus_new → CallAsync → SQS → Python worker. Every geoprocess and packager job goes through it.
api	dead code — handlers.DoStatistics / models.DoStatistics were the only importers, and neither is wired to a route. main.go never constructs an Asyncer.

Changes

async_listener — new dispatch package (130 lines) sending via aws-sdk-go-v2:

• dispatch.New(ctx, engine, target) keeps the exact ASYNC_ENGINE_* /
  ASYNC_ENGINE_*_TARGET contract, including the local/<queue-url> form that points at
  ElasticMQ in docker-compose. No infrastructure configuration changes.
• Queue URL resolution stays lazy, so a queue that is unreachable at boot does not stop the
  listener from starting — but it is now cached, where the old code called GetQueueUrl on
  every message.

api — deletes api/handlers/statistics.go and api/models/statistics.go. This is pure
dead-code removal; nothing referenced them. (For what it is worth, models.DoStatistics had a
hardcoded cwbi-data-develop bucket and a 2020 MRMS S3 key, so it looks like a long-abandoned
experiment.)

The wire format is unchanged

This is the part worth checking, because it is what would break the workers. The consumers are
Python reading raw SQS:

sqs = boto3.resource(service_name="sqs", ...)
queue = sqs.get_queue_by_name(QueueName=QUEUE_NAME)
messages = queue.receive_messages(...)

No Celery, no framework envelope — just a JSON body. This PR sends exactly that:
SendMessage(QueueUrl, MessageBody=<payload>). Nothing on the Python side changes.

Behaviour changes, stated plainly

1. Only AWSSQS and the mock are implemented. AWSSNS, AWSLAMBDA and AMQP existed
upstream. Every ASYNC_ENGINE_* value in this repo is AWSSQS or MOCK, so they looked
unused — but I could not check the deployed environment configuration, which lives outside
this repo. If any environment sets one of those three, this PR silently stops dispatching
there.

To make that failure loud rather than silent, an unimplemented engine now logs:

dispatch: engine "AWSSNS" is not implemented; falling back to a no-op sender.
Only AWSSQS performs real delivery.

Please confirm against the infra config before merging. If one of them is genuinely in
use, say so and I will implement it rather than drop it.

2. Dispatches are now bounded by a 30s timeout. The old interface took no
context.Context, so a hung send leaked its goroutine for the life of the process. Bounding it
is the main practical payoff of moving to v2.

Testing

Built and vetted locally with Go 1.26.7, using GOOS=linux GOARCH=amd64 CGO_ENABLED=0 to
match both Dockerfiles:

Module	go build ./...	go vet ./...	go mod verify	aws-sdk-go v1
async_listener	clean	clean	verified	gone
api	clean	pre-existing finding only	verified	gone

The api vet finding is models/download.go:50:2: struct field StatusID repeats json tag "status_id", which reproduces on unmodified cwbi-dev and is unrelated to this change.

Not integration tested. This is the dispatch path for every geoprocess and packager job,
and MockAsyncer never exercised any AWS code, so a compile is not sufficient evidence. Before
merging, please run the compose stack and confirm a real NOTIFY still produces a queue message
a worker consumes — both geoprocess-acquirablefile and new-download. Gate on
cwbi-test-build-push-listener and cwbi-test-build-push-api.

Closes

Both issues list api and async_listener, and aws-sdk-go v1 is gone from both modules,
so these are fully resolved.

Closes USACE/cumulus-issue-tracking#3, closes USACE/cumulus-issue-tracking#5

Issue	Severity	Package
USACE/cumulus-issue-tracking#3	MEDIUM	github.com/aws/aws-sdk-go (CVE-2020-8911)
USACE/cumulus-issue-tracking#5	LOW	github.com/aws/aws-sdk-go (CVE-2020-8912)

Worth noting for risk context: the vulnerable package is service/s3/s3crypto, and only
aws-sdk-go/aws was ever linked — s3crypto appears nowhere in either module. So the
practical exposure was already nil; this removes the finding at the source rather than
carrying a permanent risk acceptance.