fix(bootstrap): image publishing role doesn't have docker pull permis…

…sions

Using a common docker asset as base image for other docker assets requires
the image publishing role to have the `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`
and `ecr:InitiateLayerUpload` permissions.

Closes aws#14656

packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml

@@ -279,6 +279,9 @@ Resources:
               - ecr:BatchCheckLayerAvailability
               - ecr:DescribeRepositories
               - ecr:DescribeImages
+              - ecr:BatchGetImage
+              - ecr:GetDownloadUrlForLayer
+              - ecr:InitiateLayerUpload
             Resource:
               Fn::Sub: "${ContainerAssetsRepository.Arn}"
             Effect: Allow