[ECR] [request]: Add container tag as a condition key

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Enable creating IAM policies (either against the resource or a principal) to allow restricting actions against certain image tags e.g. "Deny principals from the development account to reference images via the `prod-*` tag".

**Which service(s) is this request for?**
ECR

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We have a central ECR that stores all our images with cross account policies permitting access to pull images into those accounts.

An image would be uploaded to this repository with a tag like `gc-${gitCommit}`.

This image would then be promoted to `rs-${env}` e.g. `rs-dev` for the dev environments. It would then be promoted to `rs-prd` for the production environments (simplified version with fewer environments).

We would like to be able to restrict

1. Accounts from access tags outside of their `rs-${env}` name
2. Users from pushing images to `gc-${commit}` and non-`rs-dev` tags (i.e. production builds must go via CI)

Having the central registry allows us to very easily verify if two environments are using the same tag (`rs-abc` and `rs-def` would be pointing at the same manifest hash in ECR), separating the repositories between environments would mean we would have to build separate tooling to easily view that information.

**Are you currently working around this issue?**
We can't

**Additional context**
None

**Attachments**
None

No repository files, tests, or implementation entry points are identified; start by reviewing the ECR IAM condition-key requirements in the issue. Done would mean policies can restrict image actions by container tag for the described account and promotion scenarios.

Written by the indexing model from the issue text.