(ecs): registry credential grants are not enough

### Describe the bug

When using a cross-account secret for the registry, the grants do not apply the policy to the principal's (execution role) inline policy.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

The inline execution role policy should have policy attached.

### Current Behavior

Inline policy is not working.

### Reproduction Steps

1. Create a secret from attributes (`Secret.fromSecretAttributes`)
2. Pass the secret to container definition.

```ts
const credentials = Secret.fromSecretAttributes(this, "DockerHubCredentials", {
encryptionKey: '...',
secretCompleteArn: '...',
});

taskDefinition.addContainer("nginx", {
image: ContainerImage.fromRegistry("nginx:latest", {
credentials,
}),
});
```

### Possible Solution

_No response_

### Additional Information/Context

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html#task-execution-private-auth

https://github.com/aws/aws-cdk/blob/0a55ed1a01009d28739e8f081b1ce0ad78eac73d/packages/aws-cdk-lib/aws-ecs/lib/images/repository.ts#L42-L44

### AWS CDK Library version (aws-cdk-lib)

2.202.0

### AWS CDK CLI version

2.1019.2

### Node.js Version

v22.12.0

### OS

macOS

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Reproduce the cross-account case using Secret.fromSecretAttributes and ContainerImage.fromRegistry, then inspect packages/aws-cdk-lib/aws-ecs/lib/images/repository.ts at lines 42-44. Trace how the registry credentials grant reaches the execution role, and verify that the expected inline policy is attached for the cross-account secret.

Written by the indexing model from the issue text.