Expose AWS credentials on a per-container basis

In reference to #346, I'd like to create a feature request to make credentials even more granular.

Currently, all containers within a single task definition have to share the same set of permissions, so we cannot really use _multi-container_ task definitions in sensitive scenarios. That severely limits some applications, e.g. if we want to pair each "application" container with a co-pilot "service" container on the same host. I.e. instead of hosting an actual ECS service shared by multiple "application" containers, we would like to run one "service" container per each "application" container, with different permissions for each container in the pair. An example of that could be a custom logger, or an S3 management container, or a DB instance, paired with a client-facing application, where each application container and the corresponding "service" container should be completely isolated from others, while running on a dedicated _bridge_ network, and with sensitive permissions granted only to the backend. In that case, currently we have to split them in separate tasks, put them on the _host_ network (which provides less isolation) and write a custom scheduler that would place both tasks on the same EC2 instance.

Of course, there are workarounds to that, e.g. running a single pair of tasks per each EC2 instance. Still, they may introduce an additional layer of complexity and/or unnecessary constrains on the instance size and the total number of instances (limited on the account level) .

It seems that adding "_container_ role ARN" as an option to "container overrides" would address this problem without changing the current API. This option could be used in isolation for each container when no _task_ role is configured, so no conflicts with the latter would come up. Or perhaps it could create a superset of the 2 roles, much like currently _task_ role policies apply in addition to _instance_ role policies. Or maybe it could even _override_ the _task_ role policies, though that would require more work to implement while preserving compatibility with the current behavior.

Start by reviewing the related discussion in #346 and the ECS task-definition and container-overrides concepts described here. Compare the proposed per-container role ARN with task-role behavior and the stated compatibility options. Done means containers in one task can receive appropriately isolated permissions without requiring separate tasks or host networking.

Written by the indexing model from the issue text.