[ECR Public] [request]: Extended IAM permissions for image pulling

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
I'd like to see more IAM actions for ECR Public.

Right now, the available IAM permissions are only for image pushing: what IAM entities can push images to an ECR Public repository.
Right now, if I want to pull say [CloudWatch Agent from ECR Public](https://gallery.ecr.aws/cloudwatch-agent/cloudwatch-agent) I have to allow pulling **any image** from **any ECR Public repository**. The only IAM action available is `ecr-public:GetAuthorizationToken` which cannot be restricted (it requires `*`).

I'd love to see the same IAM actions ECR Private has, like `ecr-public:BatchGetImage`, `ecr-public:BatchCheckLayerAvailability`, and `ecr-public:GetDownloadUrlForLayer` that I could restrict only to certain repositories (`resource: ["public.ecr.aws/cloudwatch-agent/cloudwatch-agent:*"]`).

**Which service(s) is this request for?**
ECR Public

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
I want to limit what images can be pulled, for added security.

**Are you currently working around this issue?**
I will mirror ECR Public repositories to ECR Private, possibly with a pull-through cache. This is wasteful and undifferentiated heavy lifting that I have to do as a customer.

**Additional context**
Related: [request for a VPC Endpoint for ECR Public](https://github.com/aws/containers-roadmap/issues/1160), which could have an Endpoint Policy with these added actions.

I also might've missed a way to restrict image pulling, in which case I apologize for the noise 🙂

**Attachments**
N/A

Start by reviewing the requested ECR Public IAM actions and the related VPC Endpoint issue linked in the request. Done would mean ECR Public supports repository-scoped pull permissions such as BatchGetImage, BatchCheckLayerAvailability, and GetDownloadUrlForLayer, allowing users to restrict image access without mirroring repositories.

Written by the indexing model from the issue text.