fix: Clean up IAM permissions required for deployment.

[jamesiarmes]

Add missing parameters and use conditions to properly scope permissions where possible.

[Copilot]

Pull Request Overview

This PR cleans up IAM permissions required for deployment by reorganizing and properly scoping permissions using resource constraints and conditions. The main focus is on improving security by limiting permissions to specific resources where possible.

Key changes include:

• Reorganized permissions into logical groups with descriptive Sids
• Added resource-level constraints to limit permissions to project-specific resources
• Implemented conditions to further scope permissions based on tags and request context

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}