[Feature Request] Add SSM support for SSH / PortForwarding

Using AWS Systems Manager allows using ssh and port forwarding without the need for the DesktopInstance to be exposed via public IP / subnet. Applying appropriate role `AmazonSSMManagedInstanceCore` to the Desktop role allows will allow management via SSM. This feature would also remove the need for updating the security group to allow access.

https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html

Example commands:

Lookup INSTANCE_ID:
```
INSTANCE_NAME="mozart-desktop"
INSTANCE_ID=$(aws ec2 --region $REGION describe-instances \
--filter "Name=tag:Name,Values=$INSTANCE_NAME" \
--query "Reservations[].Instances[?State.Name == 'running'].InstanceId[]" \
--output text)
```

SSH:

```
aws ssm --region $REGION_NAME start-session --target $INSTANCE_ID
```

Port Forwarding:
```
aws ssm --region $REGION_NAME start-session --target $INSTANCE_ID \
--document-name AWS-StartPortForwardingSession \
--parameters '{"portNumber":["8443"],"localPortNumber":["8443"]}'
```

Start with the AWS Systems Manager Session Manager documentation linked in the issue, then locate the Desktop role and security-group configuration in the repository. Determine how SSH and port forwarding should be exposed through SSM, and consider the AmazonSSMManagedInstanceCore role requirement. Done means both example session types work without a public IP or inbound security-group access.

Written by the indexing model from the issue text.