Support ecs:auto-assign-public-ip condition key for RunTask and StartTask actions

### Community Note
Please vote on this issue by adding a 👍 reaction to help the community and maintainers prioritize this request.

### Tell us about your request
The `ecs:auto-assign-public-ip` condition key should be supported for the `ecs:RunTask` and `ecs:StartTask` actions, consistent with its current support for `ecs:CreateService` and `ecs:UpdateService`.

### Which service(s) is this request for?
Amazon ECS

### Tell us about the problem you're trying to solve
Organizations implementing defense-in-depth security strategies need to enforce that ECS workloads cannot be assigned public IP addresses unless explicitly authorized. This is a common compliance and security requirement.

**Current behavior:**
- The `ecs:auto-assign-public-ip` condition key works correctly for `CreateService` and `UpdateService` actions
- The condition key is **ignored** for `RunTask` and `StartTask` actions
- Tasks launched via RunTask can receive public IPs regardless of IAM/SCP policies

**Impact:**
- Security teams cannot enforce consistent "no public IP" policies across all ECS deployment methods
- Organizations must maintain growing allowlists of subnets or task definitions in SCPs as a workaround
- Standalone tasks (common for batch jobs, one-off tasks, CI/CD) bypass security controls that work for services

### Describe the solution you'd like
Evaluate the `ecs:auto-assign-public-ip` condition key for `RunTask` and `StartTask` actions, allowing policies like:

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyPublicIPForRunTask",
"Effect": "Deny",
"Action": [
"ecs:RunTask",
"ecs:StartTask"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"ecs:auto-assign-public-ip": "ENABLED"
}
}
}
]
}
```

### Additional context
- AWS announced new ECS condition keys in February 2025, but `ecs:auto-assign-public-ip` was only implemented for CreateService/UpdateService
- Multiple AWS Support cases have been opened requesting this enhancement
- Current workarounds (subnet restrictions, task definition allowlists) require ongoing maintenance and don't provide the same level of preventive control