(aws_batch): (default executionRole doesn't have sufficient permission)

### Describe the bug

https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_batch.EcsEc2ContainerDefinition.html#executionrole mentioned (optional, default: a Role will be created). This role is map to ecs task execution role which could be omitted for EcsEc2. In that case, instance role will be used.

Also the auto generated role (https://github.com/aws/aws-cdk/blob/v2.166.0/packages/aws-cdk-lib/aws-batch/lib/ecs-container-definition.ts#L1105-L1118) seems not having sufficient permission as well. Customer usually take AmazonECSTaskExecutionRolePolicy managed policy https://docs.aws.amazon.com/batch/latest/userguide/execution-IAM-role.html.

Could we make some change to have better customer experience? If so, what is the best way to start? Thanks a lot!

FYI: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

1. We should accept null value for executionRole in EcsEc2 which means customer will use permission from instanceRole. EcsFargate still need a valid executionRole.
2. When executionRole is omitted, we should create a role with proper permission. e.g. having AmazonECSTaskExecutionRolePolicy managed policy.

### Current Behavior

It doesn't accept null value. It will generate role with empty permission or only write permission for AWS logGroup "/aws/batch/job".

### Reproduction Steps

Create job definition without executionRole.

### Possible Solution

1. allow null value for EcsEc2
2. create a executeRole with AmazonECSTaskExecutionRolePolicy when the value is omitted or undefined.

### Additional Information/Context

_No response_

### CDK CLI Version

2.150.0

### Framework Version

_No response_

### Node.js Version

18

### OS

any

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start in packages/aws-cdk-lib/aws-batch/lib/ecs-container-definition.ts, especially the auto-generated role logic around lines 1105-1118, and review the linked AWS Batch execution-role documentation. Reproduce an EcsEc2 job definition without executionRole and compare the generated permissions with the expected instance-role and AmazonECSTaskExecutionRolePolicy behavior. Done means the requested null and omitted-role cases are handled without weakening EcsFargate requirements.

Written by the indexing model from the issue text.