Privilege escalation in codepipeline ecs deploy action

The deploy action for ECS in a codepipeline attaches an `iam:PassRole` action to the codepipeline role which allows it to pass any role to ec2 and ecs-tasks:

https://github.com/aws/aws-cdk/blob/986e2814e072f0334d8470a2d60ea73dcceadfe4/packages/%40aws-cdk/aws-codepipeline-actions/lib/ecs/deploy-action.ts#L80-L91

This opens a potential privilege escalation.

The resources section of the statement should instead reference the relevant role for the ECS deployment I believe.

Start in packages/@aws-cdk/aws-codepipeline-actions/lib/ecs/deploy-action.ts at lines 80-91 and inspect how the ECS deploy action builds the CodePipeline role's iam:PassRole statement. Verify which deployment role resources should be scoped, then confirm the statement no longer permits arbitrary roles while ECS deployments still work.

Written by the indexing model from the issue text.