chore: scope down default permissions

[huanjani]

This disallows the Task Role and Instance Role from assuming Copilot-tagged roles (like EnvManager Role), and scopes down permissions of the CFN Execution Role].

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the Apache 2.0 License.

[github-actions]

🍕 Here are the new binary sizes!

Name	New size (kiB)	size (kiB)	Delta (%)
macOS (amd)	52208	51976	+0.45
macOS (arm)	53064	52812	+0.48
linux (amd)	45924	45716	+0.45
linux (arm)	45252	45060	+0.43
windows (amd)	43368	43168	+0.46

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (fe2f0b3) 69.89% compared to head (afe65f6) 70.07%.
Report is 5 commits behind head on mainline.

Additional details and impacted files

@@             Coverage Diff              @@
##           mainline    #5423      +/-   ##
============================================
+ Coverage     69.89%   70.07%   +0.17%     
============================================
  Files           299      300       +1     
  Lines         45465    45776     +311     
  Branches        295      295              
============================================
+ Hits          31780    32079     +299     
- Misses        12140    12144       +4     
- Partials       1545     1553       +8     

see 4 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.