[ECR] [request]: ECR granular permissions (IAM condition/policy to include individual images/tags)

**Tell us about your request**
ECR permissions are not granular enough and do not allow you to prevent pulls of an individual image/tag.

In a nutshell, I want to prevent an image from being pulled by my production account until it's passed some sort of test/quality gate in a pre-production environment.

Relates to:
* #169
* #140
* #17

**Which service(s) is this request for?**
ECR

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

_Current use cases:_
**Use case 1**: image-scanning has not been run, prior to utilising an image as such would like to use tags/labels to prevent pulls until an image has been marked as scanned.

**Use case 2**: an image has been found to be vulnerable and to prevent future pulls of the image. The image should be retained and not deleted for auditing purposes and for specific IAM policies/conditions to allow the image to be pulled in an isolated environment.

**Use case 3**: Apply tags at the image (not repository), that marks the image *is/ is not* allowed to be pulled. Tags at the image level should be able to be made immutable.

**Use case 4**: Support more than one scanning tool, I.e. FOSS scanning, vulnerability scans etc. We have more than one form of scan. I.e. allow IAM and conditions to prevent pulls with custom tags/labels.

Currently it is not possible to put preventative measures to pull images other than at an entire repository level or to delete an image. As such the request for granular permissions.

**Are you currently working around this issue?**
Looking to use more than one account as scanned and unscanned and replicate images once scanning has occurred.

Start by reviewing related issues #169, #140, and #17, then examine the ECR and IAM requirements described here. Done would mean a defined way to apply immutable image-level tags or conditions that prevent or allow pulls based on scanning and other quality gates.

Written by the indexing model from the issue text.