app-staging-synthesizer: asset roles should assume deploy roles when bootstrapped roles are used

### Describe the bug

Creating the file role currently looks like this, and the problem is that everyone in the account can assume this file role, and write to that S3 bucket. If the deploy role is provided we can use that instead.

```ts
private ensureFileRole() {
if (this.providedFileRole) {
// Override
this.fileRoleManifestArn = this.providedFileRole._arnForCloudAssembly();
const cfnArn = this.providedFileRole._arnForCloudFormation();
this.fileRole = cfnArn ? iam.Role.fromRoleArn(this, 'CdkFileRole', cfnArn) : undefined;
return;
}

const roleName = this.fileRoleName;
this.fileRole = new iam.Role(this, 'CdkFileRole', {
roleName,
assumedBy: new iam.AccountPrincipal(this.account),
});

this.fileRoleManifestArn = Stack.of(this).formatArn({
partition: '${AWS::Partition}',
region: '', // iam is global
service: 'iam',
resource: 'role',
resourceName: roleName,
arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
});
}
```

The workaround to this is to just supply your own file role in `this.providedFileRoles`

### Expected Behavior

n/a

### Current Behavior

n/a

### Reproduction Steps

n/a

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

latest

### Framework Version

_No response_

### Node.js Version

Node 18

### OS

Mac

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Start at the ensureFileRole() entry point in app-staging-synthesizer and trace providedFileRole/providedFileRoles alongside the deploy-role handling. Confirm the generated file role's trust policy when bootstrapped roles are used, and verify that account-wide assumption is replaced by the intended deploy-role relationship.

Written by the indexing model from the issue text.