feat(codepipeline): generate a Role for every AWS-owned Action used in a Pipeline

[skinny85]

Instead of granting permissions to the Pipeline's Role,
which results in a Policy with a very wide range of permissions,
generate a separate Role for each AWS-owned Action added to the Pipeline.
The Pipeline Role will assume each Action-specific Role
(permissions are granted for that automatically)
before the Action is executed.

Also allow customers to override that default behavior by specifying their own Role for AWS-owned Actions.

While testing this change, I realized most of our Actions were generating an incomplete set of permissions to the Pipeline's artifact Bucket
(which was missed because the Actions previously executed in the context of the Pipeline Role,
which naturally has read-write permissions to that Bucket).
Corrected that as well.

---

Please read the contribution guidelines and follow the pull-request checklist.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[skinny85]

Rebased to make 100% sure the build passes (there are a lot of integ test changes here).