(aws-stepfunctions-tasks): Tighter permissions in SubmitBatchJob

### Describe the feature

The Step Functions SubmitBatchJob task automatically adds a policy to the state machine execution role to allow submitting jobs from _any_ job definition in the account: https://github.com/aws/aws-cdk/blob/3dd0ddafa99db6b18a550e0827ce6b1f799dd552/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/batch/submit-job.ts#L309-L324

Proposed feature: scope down the permission at least to [job-definition](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-resources-for-iam-policies), i.e. `arn:${Partition}:batch:${Region}:${Account}:job-definition/${JobDefinitionName}:*`

### Use Case

Only assign the least privilege permissions needed, without having to resort to `state_machine_role.without_policy_updates()`

### Proposed Solution

_No response_

### Other Information

I don't really understand what the comment in the [configurePolicyStatements](https://github.com/aws/aws-cdk/blob/3dd0ddafa99db6b18a550e0827ce6b1f799dd552/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/batch/submit-job.ts#L309-L324) method means - was the problem that job definition (with or without revision) could not be used for resource-level permissions, or that revision was required / was not allowed?

According to documentation versions stored by Internet Wayback Machine, AWS has gone somewhat back and forth on this topic, but the [current documentation](https://docs.aws.amazon.com/batch/latest/userguide/batch-supported-iam-actions-resources.html) only refers to [_Actions, resources, and condition keys for AWS Batch_](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html). There SubmitJob lists both `job-definition` and `job-definition-revision` as optional resource types.

Based on testing with my stacks, specifying the job definition via its name and a wildcard revision is sufficient, i.e., `arn:${Partition}:batch:${Region}:${Account}:job-definition/${JobDefinitionName}:*` (leaving out `:*` results in the permissions not working).

Of course the most straightforward way would be to use the full ARNs for the job definitions, but then the permissions would need to be change each time the job definition is modified – maybe not an ideal situation.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.238.0

### AWS CDK CLI version

2.1110.0 (build 970da46)

### Environment details (OS name and version, etc.)

mac OS 26.3

Start with packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/batch/submit-job.ts, especially configurePolicyStatements and the referenced policy construction. Compare the current SubmitJob permission with the AWS Batch resource documentation and the issue’s tested ARN pattern. Done means the permission is scoped to the job definition while preserving the required revision wildcard, with existing behavior covered by the relevant task tests.

Written by the indexing model from the issue text.