fix(codepipeline): order action policy dependencies before pipeline

[faridnsh]

Issue # (if applicable)

Closes #21156

Reason for this change

A newly created pipeline can start an execution before CloudFormation finishes creating or updating an action role's IAM policy. A CodeBuild action can then fail its first codebuild:StartBuild call because the policy is not attached yet; retrying after deployment succeeds.

Description of changes

Action binding now carries the IAM policy dependencies returned by role grants to the underlying CfnPipeline. This covers CodeBuild actions and AWS-owned source actions backed by CodeCommit, CodeStar Connections, ECR, and S3. The pipeline waits on the specific policy resources changed during binding; it does not depend on entire role construct trees.

The change supports generated roles, supplied mutable roles, and mutable imported roles. A mutable imported role in another stack now orders the pipeline stack after the stack that creates its policy. An immutable imported role does not gain a synthesized policy. Cross-account and cross-stack synthesis is covered, including dependency-cycle checks.

The IAM statements and resource scopes are unchanged, and no CloudFormation resource logical IDs change. CloudFormation ordering only waits for the IAM resource operation to finish; IAM propagation is eventually consistent, so this cannot guarantee that the permission is immediately available to the first pipeline execution.

Describe any new or updated permissions being added

None. Existing IAM permissions are unchanged.

Description of how you validated changes

• Added a regression test that failed before the fix because the pipeline depended on its service role policy but not the source or shared CodeBuild action role policies. It now passes with two CodeBuild projects sharing one mutable role.
• Focused CodeBuild, CodeCommit, CodeStar Connections, ECR, S3 source action, CodePipeline, and cross-account pipeline tests pass.
• ESLint passes for all changed files; git diff --check passes.
• Package-wide build and lint could not complete in this checkout: build reports @aws-cdk/asset-awscli-v1 2.2.292 declared but 2.2.282 installed, and package lint/typecheck report missing generated modules. The full action pipeline test file also has one unrelated CloudFormation validation failure for an existing Action3 with no input artifact; the other 15 tests pass.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

⚠️ The following issue reference(s) in your PR description are not valid issues:

• DependsOn attribute for "builtinfunctionidMCodeBuildActionRoleDefaultPolicy" #21156 (does not exist)

Please make sure your PR references an existing issue using the format Closes #123.

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.