Add encryption and tag immutability to ECR repository (data-dot-all#1224

)

### Feature or Bugfix
- Bugfix

### Detail
- Currently the ecr repository created do not have encryption and tag
immutability enabled which is identified by checkov scans. This fix is
to enable both.

### Relates
[- <URL or Ticket>](data-dot-all#1200)

### Security
Please answer the questions below briefly where applicable, or write
`N/A`. Based on
[OWASP 10](https://owasp.org/Top10/en/).

- Does this PR introduce or modify any input fields or queries - this
includes
N/A
  - Is the input sanitized? N/A
- What precautions are you taking before deserializing the data you
consume? N/A
  - Is injection prevented by parametrizing queries? N/A
  - Have you ensured no `eval` or similar functions are used? N/A
- Does this PR introduce any functionality or component that requires
authorization? N/A
- How have you ensured it respects the existing AuthN/AuthZ mechanisms?
N/A
  - Are you logging failed auth attempts? N/A
- Are you using or adding any cryptographic features? N/A
  - Do you use a standard proven implementations? N/A
- Are the used keys controlled by the customer? Where are they stored?
No. This is with default encryption
- Are you introducing any new policies/roles/users? N/A
  - Have you used the least-privilege principle? How? N/A


By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.

deploy/stacks/ecr_stack.py

@@ -26,6 +26,8 @@ def __init__(
             repository_name=repository_name,
             image_scan_on_push=True,
             removal_policy=RemovalPolicy.DESTROY,
+            encryption=ecr.RepositoryEncryption.KMS,
+            image_tag_mutability=ecr.TagMutability.IMMUTABLE,
         )
 
         repo.add_lifecycle_rule(max_image_count=200)

deploy/stacks/pipeline.py

@@ -557,7 +557,7 @@ def set_ecr_stage(
         self,
         target_env,
     ):
-        repository_name = f"{self.resource_prefix}-{target_env['envname']}-repository"
+        repository_name = f"{self.resource_prefix}-{target_env['envname']}-ecr-repository"
         ecr_stage = self.pipeline.add_stage(
             ECRStage(
                 self,
@@ -580,7 +580,7 @@ def set_ecr_stage(
                     privileged=True,
                     environment_variables={
                         'REPOSITORY_URI': codebuild.BuildEnvironmentVariable(
-                            value=f"{target_env['account']}.dkr.ecr.{target_env['region']}.amazonaws.com/{self.resource_prefix}-{target_env['envname']}-repository"
+                            value=f"{target_env['account']}.dkr.ecr.{target_env['region']}.amazonaws.com/{repository_name}"
                         ),
                         'IMAGE_TAG': codebuild.BuildEnvironmentVariable(value=f'lambdas-{self.image_tag}'),
                     },