fix(core): Verify ec2 instance identity doc before using meta-data service

[ddneilson]

Before using the data from an EC2 instance identity document we should be verifying that the identity document is authentic. This change adds that check.

Testing

Testing was done by deploying an app containing:

    const availabilityZone = props.vpc.availabilityZones[0];

    const ebs = new ec2.Volume(this, 'Ebs', {
      availabilityZone,
      size: cdk.Size.gibibytes(10),
    });

    const fs = new efs.FileSystem(this, 'Efs', {
      vpc: props.vpc,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });

    const bastion = new ec2.BastionHostLinux(this, 'Bastion', {
      vpc: props.vpc,
      availabilityZone,
      instanceType: new ec2.InstanceType('t3.small'),
    });

    const mountEbs = new rfdk.MountableBlockVolume(this, {
      blockVolume: ebs,
    });
    const mountEfs = new rfdk.MountableEfs(this, {
      filesystem: fs,
    });

    mountEbs.mountToLinuxInstance(bastion.instance, {
      location: '/mnt/ebs',
    });
    mountEfs.mountToLinuxInstance(bastion.instance, {
      location: '/mnt/efs',
    });

and then checking the cloud-init-output.log on the instance to ensure that the scripts ran correctly to completion.

Also tested the metadata utilities themselves by copying the scripting over to both an AL2 & Ubuntu EC2 instance.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[grbartel]

Looks good overall. Just a couple of small comments.

[grbartel]

Looks good.

[jusiskin]

Just two minor suggestions here. Otherwise an important security improvement - great work!