Function addEcrReadPolicy

Adds ECR read-only permissions (wildcard resource) to a role.

ECR permissions require wildcard resource:

• ecr:GetAuthorizationToken is an account-level action that does not support resource-level ARNs https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerregistry.html
• ecr:BatchGetImage, BatchCheckLayerAvailability, GetDownloadUrlForLayer need access to AWS-managed SageMaker DLC repositories (account IDs vary by region) and customer repos, which cannot be enumerated at construct time. https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-roles.html#sagemaker-roles-createmodel-perms