[ECS] [Proposal]: support specifying and restricting the posix user ECS ExecuteCommand runs as

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Currently ECS ExecuteCommand always runs as root.

> When a user runs commands on a container using ECS Exec, these commands are run as the root user. The SSM agent and its child processes run as root even when you specify a user ID for the container.

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html#ecs-exec-considerations

Allow specifying the container posix user to run as, and allow restricting this in the IAM Policy conditions for the "ecs:ExecuteCommand" action.

So for example, IAM user user1 can only ExecuteCommand as posix user user1, and not as root or any other user.

**Which service(s) is this request for?**
Fargate, ECS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We allow multiple IAM users to ECS exec, currently they all run as posix user root and can modify the environment or install dotfiles in /root that then impact other users who are also execing in

**Are you currently working around this issue?**
We have mitigated it by specifying `readonlyRootFilesystem` on our task definition- which is unsupported by ECS execute:

> The SSM agent requires that the container file system is able to be written to in order to create the required directories and files. Therefore, making the root file system read-only using the readonlyRootFilesystem task definition parameter, or any other method, isn't supported.

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html#ecs-exec-considerations

We then mount writeable volumes at `/var/lib/amazon` and `/var/log/amazon` in our Dockerfile so that ECS execute works again.
This still has the issue that the ECS exec root user can mess around with the SSM ipc channel etc. in `/var/lib/amazon` so this is not entirely secure.

No repository files, tests, or entry points are identified. Start by reviewing the linked ECS ExecuteCommand considerations and the requested IAM condition behavior; done means ECS can select a POSIX user for commands and restrict that user through IAM policy conditions.

Written by the indexing model from the issue text.