(codepipeline-actions): support cross account CodeStarConnectionsSourceAction connections

How can I use the CodeStarConnectionsSourceAction to connect to a cross account `arn:aws:codestar-connections` resource?

The other account has the resource `arn:aws:codestar-connections:us-west-2:connection/aEXAMPLE-8aad-4d5d-8878-dfcab0bc441f`. It's all wired up and works.

I tried to create a policy of:

```json
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"codestar-connections:UseConnection"
],
"Resource": "arn:aws:codestar-connections:us-west-2:connection/aEXAMPLE-8aad-4d5d-8878-dfcab0bc441f"
}
}
```

And allow the pipeline account to assume that role as a trusted principal.

Then I add:

```ts
const role = new iam.Role.fromARN("Role that allows assuming above policy from cross account", { mutable: false });
const sourceAction = new codepipeline_actions.CodeStarConnectionsSourceAction({
connectionArn: "arn:aws:codestar-connections:us-west-2:connection/aEXAMPLE-8aad-4d5d-8878-dfcab0bc441f",
role: role,
// ...
});
```

Then CodePipeline assumes that role so it can use that codestar connection, but it fails with some missing S3 permissions.

How to resolve?

Start with the CodeStarConnectionsSourceAction configuration shown in the issue and reproduce the cross-account setup, including the assumed role and connection ARN. Trace the generated permissions involved in the missing S3 access; done means the source action can use the cross-account CodeStar connection without the reported S3 permission failure.

Written by the indexing model from the issue text.