ECS PoC - isolate multiple services by roles and agent-pools

[ppresto]

Hi Andy, I'm not sure if this is applicable to your repo, but wanted to contribute back my PoC changes just in case. Thanks for providing such a great base to start with!!

The demo was built to address the following:

• Automate workspace creation for (TF admin, IAM, Sentinel, ECS Platform, and service teams)
• manage credentials from a single IAM workspace (roles, agent tokens, SSM) with remote state.
• enable sentinel policies
• isolate services by agent-pool
• serviceA - team can NOT use assume-role in tf code. ECS pulls role and service team ws never needs to see it
• serviceB - same as original demo using assume-role in tf code. Sentinel policies enforce only serviceB role can be used.

FYI: I didn't add the webhook notification IaC, used a default of 2 tasks per service.