ecs-provider: check roles and permissions for selected profile

Currently the provider will check the CRD for a instance profile name (i.e. role) and use that profile if there is one. If there is no name, the provider uses a default profile name. However, there are no checks to make sure that the selected profile has the correct roles and permissions needed to perform the necessary functions.

Note: this could help prevent leftover resources caused by creating some things then failing because we don't have enough permissions.

Start with the ecs-provider path that reads the CRD instance profile and selects the default profile when none is provided. Trace the provider operations that require the profile, then define the required role and permissions and validate them before resource creation; done means insufficient permissions are reported before resources are left behind.

Written by the indexing model from the issue text.