feat(s3-deployment): apply least privilege to destination bucket policies

[amandladev]

Introduction

This change improves security by scoping IAM policies to the specific
destination key prefix instead of granting access to all bucket objects.

Changes:

• IAM policies now grant access to /<destinationKeyPrefix>/* instead of /*
• When destinationKeyPrefix is specified (e.g., 'deploy/here/', 'efs/'),
  the Lambda execution role only receives permissions for that specific prefix
• Deployments without a prefix continue to work as before with /* access
• Applies to both standard deployments and EFS-backed deployments

Security Benefits:

• Follows the principle of least privilege
• Multiple deployments to the same bucket are now isolated by prefix
• Reduces blast radius if deployment Lambda credentials are compromised
• Prevents accidental cross-deployment modifications

Affected Use Cases:
✅ Deployment with prefix: destinationKeyPrefix: 'deploy/here/'
✅ EFS-backed deployment: destinationKeyPrefix: 'efs/', useEfs: true
✅ Multiple deployments to same bucket with different prefixes
✅ Deployments without prefix (unchanged behavior)

Testing:

• Updated integration tests for all deployment scenarios
• Verified snapshots for standard, EFS, and prefixed deployments
• All existing functionality preserved with improved security posture

Fixes #35610

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[aws-cdk-automation]

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

[aws-cdk-automation]

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

[aws-cdk-automation]

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.