fix: allow runner-controlled instances SSM access

[jhatler]

This grants access to the KMS key used by SSM Session Manager to the IAM roles used by instances controlled by the runners.

Refs: #362 Signed-off-by: Jaremy Hatler hatler.jaremy@gmail.com

[infracost[bot]]

💰 Infracost report

Monthly estimate generated

Estimate details (includes details of unsupported resources and skipped projects due to errors)

``` ────────────────────────────────── Project: terraform-stacks-runners Module path: terraform/stacks/runners Errors: Failed to lookup module "spacelift.io/jhatler/runner-template/aws" - No versions found for registry module ────────────────────────────────── ────────────────────────────────── 9 projects have no cost estimate changes. Run the following command to see their breakdown: infracost breakdown --path=/path/to/code ────────────────────────────────── 162 cloud resources were detected: ∙ 15 were estimated ∙ 134 were free ∙ 13 are not supported yet, see https://infracost.io/requested-resources: ∙ 10 x aws_network_acl_association ∙ 3 x aws_s3_bucket_lifecycle_configuration ```

_{This comment will be updated when code changes.}