ec2: `grantAttachVolume` results in circular dependency

### Describe the bug

When creating an ec2 instance and then granting attach volume, it results in a circular dependency because it tries to add to the role's default policy which the instance depends on, and then the grant depends on the instance to include the instance id in the policy.

### Expected Behavior

It should not result in a circular dependency

### Current Behavior

```
❌ cdk-tst failed: Error [ValidationError]: Circular dependency between resources: [CDKTstInstanceInstanceRoleDefaultPolicyD5E89317, CDKTstInstance193C36F8]
at Request.extractError (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:46692)
at Request.callListeners (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:91437)
at Request.emit (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:90885)
at Request.emit (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:199281)
at Request.transition (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:192833)
at AcceptorStateMachine.runTo (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:157705)
at /workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:158035
at Request. (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:193125)
at Request. (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:199356)
at Request.callListeners (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:91605) {
code: 'ValidationError',
time: 2024-02-28T15:55:36.619Z,
requestId: 'eaee1eeb-528e-4f65-a48d-e5eb3620400c',
statusCode: 400,
retryable: false,
retryDelay: 351.6214032309648
}

❌ Deployment failed: Error [ValidationError]: Circular dependency between resources: [CDKTstInstanceInstanceRoleDefaultPolicyD5E89317, CDKTstInstance193C36F8]
at Request.extractError (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:46692)
at Request.callListeners (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:91437)
at Request.emit (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:90885)
at Request.emit (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:199281)
at Request.transition (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:192833)
at AcceptorStateMachine.runTo (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:157705)
at /workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:158035
at Request. (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:193125)
at Request. (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:199356)
at Request.callListeners (/workplace/cdk-tst/node_modules/aws-cdk/lib/index.js:376:91605) {
code: 'ValidationError',
time: 2024-02-28T15:55:36.619Z,
requestId: 'eaee1eeb-528e-4f65-a48d-e5eb3620400c',
statusCode: 400,
retryable: false,
retryDelay: 351.6214032309648
}

Circular dependency between resources: [CDKTstInstanceInstanceRoleDefaultPolicyD5E89317, CDKTstInstance193C36F8]```

### Reproduction Steps

```

const vpc = new ec2.Vpc(this, 'VPC');
const ec2Instance = new ec2.Instance(
this,
'Instance',
{
vpc,
instanceType: ec2.InstanceType.of(
ec2.InstanceClass.T3,
ec2.InstanceSize.MICRO
),
machineImage: new ec2.AmazonLinuxImage({
generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,
}),
}
);
const volume = new ec2.Volume(this, `volume`, {
size: Size.gibibytes(8),
availabilityZone: vpc.selectSubnets().subnets[0].availabilityZone
});

volume.grantAttachVolume(ec2Instance.role, [ec2Instance]);
volume.applyRemovalPolicy(RemovalPolicy.DESTROY);
```

### Possible Solution

Creating a new policy and attaching it to the role should remove the circular dependency since the new policy will depend on both the role and the instance.

### Additional Information/Context

_No response_

### CDK CLI Version

2.126.0

### Framework Version

_No response_

### Node.js Version

v20.10.0

### OS

OSX

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start with the ec2.Volume.grantAttachVolume call in the supplied reproduction and inspect how it adds permissions to ec2Instance.role. Reproduce the case with CDK CLI 2.126.0, then verify that synthesis or deployment no longer reports a circular dependency between the role policy and instance.

Written by the indexing model from the issue text.