fix(cli): flag report is inconsistent with warnings

The default flag report (showing the unconfigured flags) was basing its
entries on a different filter than the message that says "N flags are
unconfigured". This is confusing.

Currently, init-ing a project and then upgrading to the latest library
shows:

```
2 feature flags are not configured. Run 'cdk flags --unstable=flags' to learn more.
```

But then running that commands shows 15 flags:

```
$ cdk flags --unstable=flags
┌─────────────────────────────────────────────────────────────────────────────────────┬─────────────┬─────────┬───────────┐
│ Feature Flag Name                                                                   │ Recommended │ User    │ Effective │
├─────────────────────────────────────────────────────────────────────────────────────┼─────────────┼─────────┼───────────┤
│ Module: aws-cdk-lib                                                                 │             │         │           │
│   @aws-cdk/aws-apigateway:usagePlanKeyOrderInsensitiveId                            │ true        │ <unset> │ true      │
│   @aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021                         │ true        │ <unset> │ true      │
│   @aws-cdk/aws-ec2-alpha:useResourceIdForVpcV2Migration                             │ false       │ <unset> │ false     │
│   @aws-cdk/aws-ecs-patterns:uniqueTargetGroupId                                     │ true        │ <unset> │ false     │
│   @aws-cdk/aws-elasticloadbalancingv2:networkLoadBalancerWithSecurityGroupByDefault │ true        │ <unset> │ false     │
│   @aws-cdk/aws-lambda:recognizeVersionProps                                         │ true        │ <unset> │ true      │
│   @aws-cdk/aws-rds:lowercaseDbIdentifier                                            │ true        │ <unset> │ true      │
│   @aws-cdk/aws-stepfunctions-tasks:httpInvokeDynamicJsonPathEndpoint                │ true        │ <unset> │ true      │

...etc...
```

The reason is those 2 bits of code used different filtering.
Specifically, the warning excluded flags for which the default value is
equal to the recommended value (i.e., flags that don't need to be
configured at all because the default value is good enough), while
the table was looking strictly for "unconfigured" flags.

The `default == recommended` pattern crops up in a couple of situations:

- Security-related fixes that we want to force on people, but want to
  give them a flag to back out of the changes if they really need to.
- Flags that changed their default value in the most recent major
  version.
- Flags that we've introduced at some point in the past, but have gone
  back on.

In this PR, make both bits of code use the same logic so discrepancies
like these can't happen anymore. Also add a header to the table so
it's clear what you're currently looking at.

Also in this PR: remove a dead `flags.ts` code, that had been fully
refactored to other files but had accidentally been left in.

Author: rix0rrr

packages/aws-cdk/lib/cli/cdk-toolkit.ts

@@ -54,7 +54,6 @@ import {
 } from '../commands/migrate';
 import type { CloudAssembly, CloudExecutable, StackSelector } from '../cxapp';
 import { DefaultSelection, environmentsFromDescriptors, globEnvironmentsFromStacks, looksLikeGlob } from '../cxapp';
-import { OBSOLETE_FLAGS } from '../obsolete-flags';
 import {
   deserializeStructure,
   formatErrorMessage,
@@ -68,6 +67,7 @@ import { canCollectTelemetry } from './telemetry/collect-telemetry';
 import { cdkCliErrorName } from './telemetry/error';
 import { CLI_PRIVATE_SPAN } from './telemetry/messages';
 import type { ErrorDetails } from './telemetry/schema';
+import { FlagOperations } from '../commands/flags/operations';
 
 // Must use a require() otherwise esbuild complains about calling a namespace
 // eslint-disable-next-line @typescript-eslint/no-require-imports,@typescript-eslint/consistent-type-imports
@@ -2130,12 +2130,9 @@ export async function displayFlagsMessage(ioHost: IoHelper, toolkit: InternalToo
     return;
   }
 
-  const unconfiguredFlags = flags
-    .filter(flag => !OBSOLETE_FLAGS.includes(flag.name))
-    .filter(flag => (flag.unconfiguredBehavesLike?.v2 ?? false) !== flag.recommendedValue)
-    .filter(flag => flag.userValue === undefined);
-
+  const unconfiguredFlags = FlagOperations.filterNeedsAttention(flags);
   const numUnconfigured = unconfiguredFlags.length;
+
   if (numUnconfigured > 0) {
     await ioHost.defaults.warn(`${numUnconfigured} feature flags are not configured. Run 'cdk flags --unstable=flags' to learn more.`);
   }