Resource Provider CodeBuild projects use permissive role

[tomwwright]

The CloudFormation CLI deploys a CloudFormationManagedUploadInfrastructure stack during cfn submit to handle uploading the handlers package. It also deploys a stack for the resource provider's execution role.

To cater for this functionality, the CodeBuild role for deploying a resource provider has an overly permissive policy:

...
- PolicyDocument:
    Version: "2012-10-17"
    Statement:
      - Action:
          - cloudformation:*
          - iam:*
          - kms:*
          - s3:*
        Effect: "Allow"
        Resource: "*"
  PolicyName: CloudFormationManagedUploadInfrastructure