feat: Restrict IAM Lambda secret rotation role (DBTP-2964)

[BenFielder]

Addresses https://uktrade.atlassian.net/browse/DBTP-.

---

Checklist:

Title:

• Conforms to our pull request title guidance. E.g. feat: Add new feature (DBTP-1234) or chore: Correct typo (off-ticket)

Description:

• Link to ticket included (unless it's a quick out of ticket thing)
• Includes tests (or an explanation for why it doesn't)
• If the work includes user interface changes, before and after screenshots included in description
• Includes any applicable changes to the documentation in this code base
• Includes link(s) to any applicable changes to the documentation in the DBT Platform Documentation (can be to a pull request)

Tasks:

• Run the end to end tests for this branch and confirm that they are passing

Reviewer Checklist

• I have reviewed the PR and ensured no secret values are present

[github-actions]

Your PR has commits that are missing the Signed-off-by trailer. This is likely due to the pre-commit hook not being configured on your local machine. The usual fix for this issue is to run pre-commit install --install-hooks --overwrite -t commit-msg -t pre-commit, however for more detailed help in setting up the pre-commit hooks, follow the instructions at https://github.com/uktrade/github-standards/blob/main/README.md#usage

[github-actions]

Dependency Review

✅ No vulnerabilities or OpenSSF Scorecard issues found.

Scanned Files

None