[feature] principal tags on EC2 instance IAM roles

[joemiller]

Describe the solution you'd like

It would be useful to be able to specify tags to add to the EC2 instance IAM roles created by the stack. That would simplify certain configurations. For example, let's say you have a bunch of different instances of the stack deployed, each for a different BK 'queue', and you wanted to give access to a common S3 bucket to all of them. Having principal tags on the IAM role would allow writing a simple ABAC-style bucket policy rather than having to enumerate each stack's instance IAM role in the policy