Feature Request: role_arn per log group

Currently there is a `role_arn` which allows all logs to be sent to another account. This operates (afaict) on a global level - either all metrics & logs, or all logs or all metrics.

In the nature of our distributed accounts this is unworkable for us - teams want their logs in their account while a security team wants specific logs forwarded to their audit account.

Having `role_arn` at an individual `collect_list` item level would be ideal.

No files or tests are named. Start by locating the current global role_arn handling and the collect_list configuration path; determine how a role per log-group item should interact with existing global metrics and log forwarding, then define validation and expected cross-account behavior.

Written by the indexing model from the issue text.