[ECS] [request]: Policies to ensure container image attestation

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
ECS currently doesn't have a native, *declarative* mechanism to ensure only images signed with a certain key. The reference relies on running verification in a separate Lambda which adds complexity. It would be nice to define a clear, declarative policy in CDK/CloudFormation.

**Which service(s) is this request for?**
ECS/Fargate

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Allow only images built and signed in a CI/CD pipeline (CodePipeline, GitHub Actions etc) can be run. This ensures unwanted code is not run.

**Are you currently working around this issue?**
Reference solution can be used as a workaround.

**Additional context**
AWS reference implementation: https://containersonaws.com/pattern/ecs-fargate-container-image-signing-and-verification
k8s policy controller documentation: https://docs.sigstore.dev/policy-controller/overview/

**Attachments**
None