Pull in cfnsignal only for AWS k8s and ecs variants

**What I'd like:**
By default, all downstream builders whose image matches `aws-*` will get `cfsignal` installed. This isn't ideal because those downstream builders might not include in their variant the APIs required by this feature, which will cause the system to be in a degraded state. We have to narrow down when `cfsignal` is required by only installing it for the `aws-k8s` and `aws-ecs` families. If downstreams require this feature, they can explicitly require it in their variant definition.

**Any alternatives you've considered:**
Keep `cfsignal` and the system in a degraded state for downstream builders.