aws_ec2: Support making BastionHost default role policy less permissive (no wildcards in Allow: Action: *)

### Describe the feature

The current deployment of a `aws_ec2.BastionHost(...)` deploys a CloudFormation template with an overly permissive default policy:

```json
"bastionInstanceRoleDefaultPolicyF19D0FC0": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"cloudformation:DescribeStackResource",
"cloudformation:SignalResource"
],
"Effect": "Allow",
"Resource": {
"Ref": "AWS::StackId"
}
},
{
"Action": [
"ssmmessages:*",
"ssm:UpdateInstanceInformation",
"ec2messages:*"
],
"Effect": "Allow",
"Resource": "*"
}
],
"Version": "2012-10-17"
},
"PolicyName": "bastionInstanceRoleDefaultPolicyF19D0FC0",
"Roles": [
{
"Ref": "bastionInstanceRole961823F4"
}
]
},
"Metadata": ....
},
```

The problem is when executing `cfn_nag` checks on the CloudFormation template:

```
cfn-nag check:
| FAIL F4
|
| Resource: ["bastionInstanceRoleDefaultPolicyF19D0FC0"]
| Line Numbers: [1604]
|
| IAM policy should not allow * action
```

### Use Case

Cloud Formation templates shouldn't allow an `"Resource": "*"` policy.

### Proposed Solution

The default policy should be changed to a less permissive policy, at least setting a custom role / policy like used for the `aws_ec2.Instance` construct should be allowed.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.24.0

### Environment details (OS name and version, etc.)

Ubuntu 18.4 / NodeJS 16.15.0 / Python 3.8.13

Start at the aws_ec2.BastionHost implementation and its synthesized default IAM policy; compare how aws_ec2.Instance permits a custom role or policy. Define the supported policy customization and verify the synthesized CloudFormation template no longer triggers cfn-nag F4 for wildcard permissions.

Written by the indexing model from the issue text.