When not managing IAM role, don't require permission to pass role

We use a continuous deployment role with limited privileges. In particular, the deployment role has read-only IAM permissions. When first deploying the function, we use a privileged account that sets up the Lambda IAM role and policy. (We turn off policy autogeneration.)

Up to and including Chalice 0.9, the deploy command correctly did not try to write anything to IAM. However, starting with Chalice 0.10, the call to update_function_configuration unconditionally tries to update the Lambda IAM role ARN, even if it has not changed. This results in an error of this form:

```
An error occurred (AccessDeniedException) when calling the
UpdateFunctionConfiguration operation: User:
arn:aws:iam::ACCT:user/CI-USER is not authorized to perform:
iam:PassRole on resource: arn:aws:iam::ACCT:role/lambda-dev
```
Obviously, allowing iam:PassRole would defeat the whole purpose/premise of restricting privileges of the CI/CD account.

I propose that the update_function_configuration step compute a diff of what has actually changed, and not try to modify Lambda settings that have not changed.

Start at the deployment path that calls update_function_configuration and inspect how the desired Lambda settings are compared with the current configuration. Reproduce the deployment with a read-only IAM role and verify that an unchanged role ARN does not require iam:PassRole, while changed Lambda settings still update correctly.

Written by the indexing model from the issue text.