[AWS::ServiceDiscovery::Service] - [BUG] - Impossible to create in shared namespace on tagged stack

### Name of the resource

AWS::ServiceDiscovery::Service

### Resource Name

_No response_

### Issue Description

It is currently impossible to create a new Cloud Map service in a shared namespace on a stack that contains any stack level tags.

This is because shared Cloud Map namespaces don't have the "servicediscover:TagResource" and "servicediscovery:UntagResource" permissions. Even when creating a custom RAM permission it is impossible to add these to the share. There is an AWS managed policy that includes these permissions, but it is scoped to only allow the ECS service managed role to use them and cloning this into a custom policy seems to be impossible.

As a result, attempting to create a service in a namespace that has been shared from another account will always fail due to it trying and failing to add the stack level tags.

While I can't confirm, I assume this also impacts `AWS::ServiceDiscovery::Instance` as well.

### Expected Behavior

As tagging resources in shared namespaces is impossible, presumably it would just not add tags if it detects a cross account namespace.

Ideally the RAM policy itself or the restrictions around it would be fixed to allow tags to be added in contexts other than ECS.

Less than ideal would be a field that denotes the resource as being for a remote account which causes the tags to be suppressed.

### Observed Behavior

A service created with no tags on the resource fails with:

```
Resource handler returned message: "User: arn:aws:sts::123456789012:assumed-role/role-name/session-name is not authorized to perform: servicediscovery:TagResource on resource: arn:aws:servicediscovery:us-east-1:098765432109:service/srv-* because no resource-based policy allows the servicediscovery:TagResource action
```

### Test Cases

Create a stack that has stack level tags an tries to create a service on a shared Cloud Map namespace:

```
AWSTemplateFormatVersion: '2010-09-09'
Resources:
ExampleService:
Type: AWS::ServiceDiscovery::Service
Properties:
DnsConfig:
DnsRecords:
- TTL: 10
Type: A
RoutingPolicy: MULTIVALUE
Name: example-service
NamespaceId: arn:aws:servicediscovery:us-east-1:098765432109:namespace/ns-1234567890123456
```

### Other Details

_No response_

Start by reproducing the failure with the provided CloudFormation template, stack-level tags, and a shared Cloud Map namespace. Investigate whether CloudFormation can detect the cross-account namespace and suppress tagging; done would require an agreed, implementable behavior for AWS::ServiceDiscovery::Service, and possibly AWS::ServiceDiscovery::Instance, without the unauthorized TagResource call.

Written by the indexing model from the issue text.