(pipelines/bootstrap): add Permission Boundary to bootstrap resources

The `cdk bootstrap` command will be able to be invoked as follows:

```
$ cdk bootstrap --permissions-boundary=arn:aws:iam::account-id:policy/policy-name-with-path
```

This sets the CloudFormation Execution Role up to enforce its use.

When users add:

```
{
"context": {
"@aws-cdk/core.permissionsBoundary": "arn:aws:iam::account-id:policy/policy-name-with-path"
}
}
```

To their `cdk.json`, all Roles in all stacks will be provisioned with that permission boundary automatically.

---

This is a :rocket: Feature Request

Start at the `cdk bootstrap` command and the `cdk.json` context shown in the issue. Trace how bootstrap resources and stack Roles are created, then verify that both inputs apply the requested permission boundary consistently. Done means the command option and context setting enforce the boundary as described for the relevant roles.

Written by the indexing model from the issue text.