Add more options for generating trust policy

Description

Trust role policy generated for IAM role does not have controls for conditionals like aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, or aws:SourceOrgPaths used for confused deputy problem prevention. Workaround for the problem is to provide custom trust policy with appropriate conditions for role assumption, however I think we should promote good security practices and have some of these controls added to role modules and perhaps enabled by default at some point in the future.

If approved I'm willing to submit PR (for start maybe just one conditional, like aws:SourceAccount) with backward compatible changes to test it out.

[X] ✋ I have searched the open/closed issues and my issue is not listed.

Versions

Module version [Required]: 5.28.0
Terraform version: Terraform v1.7.5 registry.terraform.io/hashicorp/aws v5.58.0

Steps to reproduce the behavior:

module "test_role" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
  version = "5.28.0"

  trusted_role_services = [
    "ec2.amazonaws.com"
  ]

  create_role             = true
  create_instance_profile = true

  role_name         = "test_role"
  role_description  = "Test role"
  role_requires_mfa = false

  custom_role_policy_arns = [
    "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
  ]
}

Generated trust policy looks like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": [
                "sts:TagSession",
                "sts:AssumeRole"
            ]
        }
    ]
}

Expected behavior

We should be able to generate policy like this

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com"
            },
            "Action": [
                "sts:TagSession",
                "sts:AssumeRole"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "<account id>"
                }
            }
        }
    ]
}

Actual behavior

There is no option to add conditions except for: aws:PrincipalArn

terraform-aws-modules / terraform-aws-iam