NRL-1938 Add CI policies to mgmt account

[mattdean3-nhs]

All polices that have been added are unchanged from those defined in the NRLF-CI repo.

Other changes include:

• Create a ci-data bucket that can be used for workflow files and switch workflows to use it
• Add a var for the org-wide NHSDeveloper role name
• Lock-down the codebuild ECR access to only the read actions needed by codebuild (hopefully)

Once we're happy with this PR, I'll destroy the TF state from the NRLF-CI repo and then re-create the policies as part of the mgmt acc-wide deployment.

[github-actions]

🚀 PR environment successfully deployed.
Commit Hash: e682167526f3917100bf3df284f373ec35dca3e7
URL: https://nrl1938-01ba47.api.record-locator.dev.national.nhs.uk/

[github-actions]

🚀 PR environment successfully deployed.
Commit Hash: fed7cf3a37b0c52cac2667757b6721fa6f694380
URL: https://nrl1938-01ba47.api.record-locator.dev.national.nhs.uk/

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🚀 PR environment successfully deployed.
Commit Hash: cff34d381e011511dedfd71f11f53b53c44cd3c0
URL: https://nrl1938-01ba47.api.record-locator.dev.national.nhs.uk/