(ec2): VPC flow log ECS record fields don't work

### Describe the feature

VPC flow logs support various ECS fields if one of the participants in the log record is an ECS task.

https://docs.aws.amazon.com/vpc/latest/userguide/flow-log-records.html

The documentation for each of these fields says:
> To include this field in your subscription, you need permission to call ecs:XXX.

Where the exact permission varies. I'm guessing "you" means the flow logs service principal `vpc-flow-logs.amazonaws.com`, though I'm honestly not certain. Regardless, CDK generates no such grants, so these ECS fields are always empty even when ECS is involved in the flow.

### Use Case

I want to investigate NAT gateway usage by ECS tasks. Without these records working, I have to correlate task ENI IP addresses to those appearing in the flow logs.

### Proposed Solution

If any of the ECS LogFormats are used, FlowLog should grant the appropriate permissions.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.178.1

### Environment details (OS name and version, etc.)

N/A

Start at the FlowLog and ECS LogFormats entry points named in the issue, then compare the required ecs:XXX permissions with the AWS VPC flow-log-records documentation. Resolve which principal should receive the grants. Done means selecting ECS LogFormats causes the appropriate permissions to be granted and the corresponding ECS fields to work in flow-log records.

Written by the indexing model from the issue text.