aws-iam: Instance Profile default role breaks ECS Service Connect agent

### Describe the bug

In ECS services using an EC2 capacity provider strategy, an instance profile supplied to the launch template used in the auto scaling group places a condition on the `ecs:Poll` action in the instance profile's role that prohibits the Service Connect sidecar container from properly initializing.

### Expected Behavior

The instance profile should grant `eco:Poll` to `AWS:${Cluster/InstanceProfile/InstanceRole}` to container instances.

### Current Behavior

The instance profile grants the correct action and resource string, but includes the following condition, which restricts the connection.
```
"ArnEquals": {
"ecs:cluster": "${Cluster.Arn}"
}
```

### Reproduction Steps

Deploy a Service Connect-configured service with an EC2 capacity provider to an ECS cluster. Tasks will not start due to an unhealthy service connect agent which does not have authorization to poll the ECS management interface.

### Possible Solution

Do not restrict the `ecs:Poll` action.

### Additional Information/Context

_No response_

### CDK CLI Version

2.118.0 (build a40f2ec)

### Framework Version

aws-cdk-lib@2.118.0

### Node.js Version

v20.9.0

### OS

macOS 14.2.1

### Language

TypeScript

### Language Version

TypeScript (5.3.3)

### Other information

_No response_

Start by reproducing the ECS Service Connect deployment with an EC2 capacity provider and inspect the generated instance profile role policy for ecs:Poll. Done means the policy no longer restricts ecs:Poll with the ecs:cluster condition and the Service Connect agent initializes successfully.

Written by the indexing model from the issue text.