[ECS]: Resource-level permissions for Task Definitions

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Support resource-level permissions for Task Definitions. `ecs:*TaskDefinition` actions should be able to be scoped to a `task-definition` ARN.

**Which service(s) is this request for?**
ECS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Our CI needs to update services in a specific ECS cluster to run a new image tag. It does this by describing the ECS Service, describing the current task definition, registering a new task definition (with the image tag changed), and updating the Service to run the new task definition. We want the permissions granted to the CI user to be as limited as possible; the ECS Service permissions are scoped to the ECS cluster, but there is currently no way to scope the task definition permissions.

**Are you currently working around this issue?**
We have to grant the CI user permission to describe and register all task definitions. If these credentials are leaked they could be used to view information in task definitions for other ECS clusters, and register new versions of any task definition.

**Additional context**
The documentation states that resource-level permissions are not available for task definitions.
https://docs.aws.amazon.com/AmazonECS/latest/userguide/ecs-supported-iam-actions-resources.html
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_id-based-policy-examples.html#IAM_task_definition_policies
https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonelasticcontainerservice.html

Start with the linked ECS supported-actions and IAM policy documentation to understand the current task-definition permission limits. The issue names no repository files, tests, or implementation entry point, so this is an AWS ECS/IAM design request rather than a self-contained code change. Done means ECS task-definition actions can be scoped to a task-definition ARN.

Written by the indexing model from the issue text.