Change BCGOV_WORKLOAD_readonly Role to use the Readonly Policy

**Describe the bug**
One of our 5 roles for the platform is the "BCGOV_WORKLOAD_readonly" (maybe inaptly named "Viewer") is currently using the AWS managed policy "ViewOnlyAccess" which gives the user the ability to see that resources exist, but no details about them. Our users have voiced that this is not adequate permissions for this role. specifically:

- I can't view lambda functions
- I can't view SecurityHub findings

A suggested increase in access is the AWS managed policy "ReadOnlyAccess".

**Additional context**
https://github.com/bcgov-c/aws-ecf-forge-workspaces-settings-stack/blob/71f7f7ffc93672fec995e1cc226e3e800c67a3ae/projects/sso.json#L39

**Definition of done**
- [ ] In Forge, change the policy on the "BCGOV_WORKLOAD_readonly" role from "ViewOnlyAccess" to "ReadOnlyAccess"
- [ ] Test that the aforementioned use case works now (can view lambda functions, and security hub findings)
- [ ] In Assembly, change the policy on the "BCGOV_WORKLOAD_readonly" role from "ViewOnlyAccess" to "ReadOnlyAccess"
- [ ] In Live, change the policy on the "BCGOV_WORKLOAD_readonly" role from "ViewOnlyAccess" to "ReadOnlyAccess"

Start with the linked projects/sso.json reference around line 39 to locate the BCGOV_WORKLOAD_readonly role and its current ViewOnlyAccess policy. Trace where the role is configured for Forge, Assembly, and Live, then verify the change by testing access to Lambda functions and SecurityHub findings in each environment.

Written by the indexing model from the issue text.