(batch): Add grant methods to batch constructs where necessary

## Updated issue:

add `grantSubmitJob` to job definitions and job queues
add make managed compute environments implement `IGrantable` with `instanceRole` as the `grantPrincipal`

## Original Issue:
### JobDefinitionContainer `job_role`
The [JobDefinitionContainer](https://docs.aws.amazon.com/cdk/api/latest/python/aws_cdk.aws_batch/JobDefinitionContainer.html#jobdefinitioncontainer) in the AWS Batch service is, from what I understand, supposed to hold a [job_role](https://docs.aws.amazon.com/cdk/api/latest/python/aws_cdk.aws_batch/JobDefinitionContainer.html#aws_cdk.aws_batch.JobDefinitionContainer.job_role) that gets created automatically if none is provided during instantiation.

> The IAM role that the container can assume for AWS permissions. Default: - An IAM role will created.

However when requesting this role to assign the proper grants on a database key, that attribute is undefined.

### ComputeResources `instance_role`
Similar issue happens with the `instance_role` :

The [ComputeResources](https://docs.aws.amazon.com/cdk/api/latest/python/aws_cdk.aws_batch/ComputeResources.html) in the AWS Batch service is, as well, supposed to hold an [instance_role](https://docs.aws.amazon.com/cdk/api/latest/python/aws_cdk.aws_batch/ComputeResources.html#aws_cdk.aws_batch.ComputeResources.instance_role) that gets created automatically if none is provided during instantiation.

> The Amazon ECS instance profile applied to Amazon EC2 instances in a compute environment. [...] Default : a new role will be created.

However when requesting this role to assign the proper grants on a database key, that attribute is undefined.

### Reproduction Steps

The `JobDefinitionContainer` is created using the following code and coupled with the traditional AWS Batch components : job definition, job queue and compute environment.

```python
# Container definition (createdb)
batch_createdb_container = batch.JobDefinitionContainer(
image=ecs.ContainerImage.from_ecr_repository(repository=repo, tag=app_tag),
command=["-m", "app.scripts.createdb"],
environment=environment_variables,
memory_limit_mib=2048,
)
```

The decrypt permission (grant) is made with the following :

```python
database.secret.encryption_key.grant_decrypt(batch_createdb_container.job_role)
```

Note that all the batch components are created if that grant above is commented out.

### What did you expect to happen?

I would expect that the `job_role` be populated properly (as described in the documentation) so that it can be used in grant statements as depicted above.

### What actually happened?

The following error is received when a `cdk diff` or `cdk deploy` is performed :

```
....
File "/path/furley-0NV7C4_t-py3.9/lib/python3.9/site-packages/aws_cdk/aws_kms/__init__.py", line 1515, in grant_decrypt
return typing.cast(aws_cdk.aws_iam.Grant, jsii.invoke(self, "grantDecrypt", [grantee]))
File "/path/furley-0NV7C4_t-py3.9/lib/python3.9/site-packages/jsii/_kernel/__init__.py", line 128, in wrapped
return _recursize_dereference(kernel, fn(kernel, *args, **kwargs))
File "/path/furley-0NV7C4_t-py3.9/lib/python3.9/site-packages/jsii/_kernel/__init__.py", line 340, in invoke
response = self.provider.invoke(
File "/path/furley-0NV7C4_t-py3.9/lib/python3.9/site-packages/jsii/_kernel/providers/process.py", line 359, in invoke
return self._process.send(request, InvokeResponse)
File "/path/furley-0NV7C4_t-py3.9/lib/python3.9/site-packages/jsii/_kernel/providers/process.py", line 326, in send
raise JSIIError(resp.error) from JavaScriptError(resp.stack)
jsii.errors.JSIIError: Got 'undefined' for non-optional instance of {"name":"grantee","type":{"fqn":"@aws-cdk/aws-iam.IGrantable"}}
Subprocess exited with error 1
```

### Environment

- **CDK CLI Version :** 1.117.0 (build 0047c98)
- **Framework Version:** 1.117.0
- **Node.js Version:** v15.8.0
- **OS :** MacOS v11.4 (20F71)
- **Language (Version):** Python 3.9.5

### Other

I am essentially trying to do the equivalent of the following code (Lambda) but for Batch :

```python
database.secret.encryption_key.grant_decrypt(lambda_container.grant_principal)
database.secret.grant_read(lambda_container.grant_principal)
```
I just can't seem to find a valid `IGrantable` in any of the Batch constructs.
If there's a better way to assign a read grant for a database secret to a batch job, please let me know !

---

This is :bug: Bug Report

Inspect the AWS Batch constructs named in the issue, especially JobDefinitionContainer, job definitions, job queues, ComputeResources, and managed compute environments. Start by tracing how their default roles are created and how existing IGrantable implementations expose grantPrincipal; done means grantSubmitJob is available where requested and managed compute environments use instanceRole for grants, with coverage for the described default-role cases.

Written by the indexing model from the issue text.