BastionHost: Use managed policy AmazonSSMManagedInstanceCore

### Describe the feature

Hello,

I would like to request that BastionHost uses arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore instead of
https://github.com/aws/aws-cdk/blob/4303dca8ab1f690147d6a64d333118ac90297035/packages/%40aws-cdk/aws-ec2/lib/bastion-host.ts#L193

This would result in reduces privileged (No need to create or delete parameters, windows, associations, etc).

Regards,

### Use Case

Implement least privilege for EC2 instance.

### Proposed Solution

Create role separately similar to
https://github.com/aws-samples/secure-bastion-cdk/blob/main/lib/aws-bastion-ec2-cdk-stack.ts#L44

### Other Information

Alternative solution:
Copying SSMManagedInstanceCorePolicy (may break when new features are added to SSMº

### Acknowledgements

- [X] I may be able to implement this feature request
- [X] This feature might incur a breaking change

### CDK version used

2.39.0

### Environment details (OS name and version, etc.)

OSX

Start in packages/@aws-cdk/aws-ec2/lib/bastion-host.ts at the referenced policy setup, then compare the separate-role approach in aws-samples/secure-bastion-cdk/lib/aws-bastion-ec2-cdk-stack.ts. The change is complete when BastionHost uses arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore while preserving the requested least-privilege behavior and accounting for the possible breaking change.

Written by the indexing model from the issue text.