(aws_cdk.pipelines): ConfirmPermissionsBroadening only diffs on template differences

### Describe the bug

When using the ConfirmPermissionsBroadening check on a cross account stage, the CodeBuild project lacks permissions to assume neccesary roles in the target account, cannot create a cfn changeset and performs a diff only on template differences.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

A cloudformation changeset is being created in the target account and used as source to evaluate security related changes.

### Current Behavior

Changeset cannot be created due to missing permissions on the Codebuild projects
```
fail: Could not assume role in target account using current credentials (which are for account ) User: arn:aws:sts:::assumed-role/CdkCrossAccountConfirmPer-PipelinePipelinesSecurity-/AWSCodeBuild- is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam:::role/cdk-hnb659fds-file-publishing-role--eu-central-1 . Please make sure that this role exists in the account. If it doesn't exist, (re)-bootstrap the environment with the right '--trust', using the latest version of the CDK CLI.
--
Could not create a change set, will base the diff on template differences (run again with -v to see the reason)

```

The target account is properly bootstrapped, the trust policy of the file publishing role allows sts assume role from the source account.
The codebuild service role has a condition on the relevant policy that prevents assuming the file publishing role:

```
{
"Condition": {
"ForAnyValue:StringEquals": {
"iam:ResourceTag/aws-cdk:bootstrap-role": [
"deploy"
]
}
},
"Action": "sts:AssumeRole",
"Resource": "*",
"Effect": "Allow"
},
```

### Reproduction Steps

```typescript
import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import { Repository } from "aws-cdk-lib/aws-codecommit";
import {
CodePipeline,
CodePipelineSource,
ConfirmPermissionsBroadening,
ShellStep,
} from "aws-cdk-lib/pipelines";
import * as sqs from "aws-cdk-lib/aws-sqs";

export class ExampleStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);

const queue = new sqs.Queue(this, "ExampleQueue");
}
}

class MyApplication extends cdk.Stage {
constructor(scope: Construct, id: string, props?: cdk.StageProps) {
super(scope, id, props);
new ExampleStack(this, "ExampleStack");
}
}

export class CdkCrossAccountConfirmPermissionBroadeningStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);

const repo = new Repository(this, "CodeCommitRepo", {
repositoryName: "TestRepo",
});

const pipeline = new CodePipeline(this, "Pipeline", {
pipelineName: "CodeArtifactNPMPipeline",
crossAccountKeys: true,
synth: new ShellStep("Synth", {
input: CodePipelineSource.codeCommit(repo, "main"),
commands: ["npm ci", "npm run build", "npx cdk synth"],
}),
});

const stage = new MyApplication(this, "Prod", {
env: { account: "", region: "eu-central-1" },
});
pipeline.addStage(stage, {
pre: [new ConfirmPermissionsBroadening("Check", { stage })],
});
}
}
```

### Possible Solution

Fix the codebuild role

### Additional Information/Context

_No response_

### CDK CLI Version

2.176.0

### Framework Version

_No response_

### Node.js Version

v23.4.0

### OS

MacOS

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start at the ConfirmPermissionsBroadening pipeline entry point and inspect how its CodeBuild project role is generated for cross-account stages. Reproduce the supplied TypeScript example, then verify that the target-account CloudFormation change set can be created instead of falling back to template differences.

Written by the indexing model from the issue text.