fix(cli): image publishing role doesn't have docker pull permissions (#…

…14662)

Using a common docker asset as base image for other docker assets requires
the image publishing role to have the `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`
and `ecr:InitiateLayerUpload` permissions.

Closes #14656


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml

@@ -342,6 +342,8 @@ Resources:
               - ecr:BatchCheckLayerAvailability
               - ecr:DescribeRepositories
               - ecr:DescribeImages
+              - ecr:BatchGetImage
+              - ecr:GetDownloadUrlForLayer
             Resource:
               Fn::Sub: "${ContainerAssetsRepository.Arn}"
             Effect: Allow