ecr: When creating multiple repositories, the provider role only includes one in its policy

### Describe the bug

When creating multiple repositories using the Repository construct in conjunction with an aws lifecycle policy, only one of the repositories is added to the CustomECRAutoDeleteImagesCustomResourceProviderRole policy resources.

### Expected Behavior

Both repositories are added to the role policy resources e.g.
`"Resource": [
{
"Fn::GetAtt": [
"Repository15A6F32E1",
"Arn"
]
},
{
"Fn::GetAtt": [
"Repository25C81E63B",
"Arn"
]
}
]`

### Current Behavior

Only the first repository is added to the role policy resources e.g.
`"Resource": [
{
"Fn::GetAtt": [
"Repository15A6F32E1",
"Arn"
]
}
]`

### Reproduction Steps

I have the following stack defined:

```
import { RemovalPolicy, Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { Repository, TagStatus } from 'aws-cdk-lib/aws-ecr';

export class TestECRStack extends Stack {
constructor(scope: Construct, id: string, namePrefix: string, props?: StackProps) {
super(scope, id, props);
const repository = new Repository(this, 'Repository1', {
autoDeleteImages: true,
imageScanOnPush: true,
removalPolicy: RemovalPolicy.DESTROY,
repositoryName: 'rep-one',
});
repository.addLifecycleRule({
description: 'Delete untagged images if more than one.',
maxImageCount: 1,
rulePriority: 1,
tagStatus: TagStatus.UNTAGGED,
});
const repository2 = new Repository(this, 'Repository2', {
autoDeleteImages: true,
imageScanOnPush: true,
removalPolicy: RemovalPolicy.DESTROY,
repositoryName: 'rep-two',
});
repository2.addLifecycleRule({
description: 'Delete untagged images if more than one.',
maxImageCount: 1,
rulePriority: 1,
tagStatus: TagStatus.UNTAGGED,
});
}
}
```

Using this stack e.g.

```
import { Stack } from "aws-cdk-lib";
import { TestECRStack } from "../lib/test-ecr-stack";
import { Template } from "aws-cdk-lib/assertions";

const rootStack = new Stack(undefined, 'TestStack');
const stack = new TestECRStack(rootStack, 'TestStack', 'blubb', {});
const template = Template.fromStack(stack);
console.log(JSON.stringify(template));
```

results in the following role template:

```
"CustomECRAutoDeleteImagesCustomResourceProviderRole665F2773": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
}
}
]
},
"ManagedPolicyArns": [
{
"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}
],
"Policies": [
{
"PolicyName": "Inline",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecr:BatchDeleteImage",
"ecr:DescribeRepositories",
"ecr:ListImages",
"ecr:ListTagsForResource"
],
"Resource": [
{
"Fn::GetAtt": [
"Repository15A6F32E1",
"Arn"
]
}
]
}
]
}
}
]
}
}
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.70.0 (build c13a0f1)

### Framework Version

_No response_

### Node.js Version

v16.18.1

### OS

Amazon Linux 2

### Language

Typescript

### Language Version

4.9.5

### Other information

_No response_

Start from the ECR Repository construct and the generated CustomECRAutoDeleteImagesCustomResourceProviderRole policy. Reproduce the issue with the two-repository stack shown and inspect the synthesized CloudFormation template. Done means the policy's Resource list contains both repository ARNs while preserving the existing single-repository behavior.

Written by the indexing model from the issue text.