(pipelines): add assumeRole parameter to CodeBuildStep

### Description

Adds an `assumeRole` property to `pipelines.CodeBuildStep` which takes an `iam.Role` object, e.g.,

```typescript
const role = iam.Role.fromRoleArn(this, 'Role', 'arn:aws:iam::123456789012:role/MyExistingRole')

const step = new CodeBuildStep('Test', {
// ...
assumeRole: role,
})
```

such that `commands` configured in `step` are executed under `role`.

### Use Case

When we consider a cross-account deployment pipeline, we need to perform actions on the deployed resources from inside the pipeline. For example:

* Run a Lambda to perform a database migration.
* Create Cognito users for integration tests.

### Proposed Solution

If an `assumeRole` parameter is provided to a `CodeBuildStep`, we need to

1. add a `PolicyStatement` allowing to assume the `role`, e.g.,
```typescript
new PolicyStatement({
effect: Effect.ALLOW,
actions: ['sts:AssumeRole'],
resources: [role.arn],
})
```

2. assume the role inside the container and change the default AWS profile, e.g.,

```bash
aws configure --profile stage set role_arn $AWS_IAM_ROLE
aws configure --profile stage set credential_source EcsContainer

export AWS_PROFILE=stage
```

### Other information

The feature is a pragmatic workaround to https://github.com/aws/aws-cdk/issues/9625.

### Acknowledge

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

Locate the TypeScript implementation and tests for pipelines.CodeBuildStep, then trace how its IAM policy and CodeBuild container environment are configured. Done means an optional assumeRole accepts an iam.Role, permits sts:AssumeRole, and makes commands run under that role, with coverage for the configured behavior.

Written by the indexing model from the issue text.