fix(iam): cannot grant lambda:InvokeFunction on ManagedPolicy or Policy via grantInvoke() method

[Tietew]

Issue # (if applicable)

Closes #32980.

Reason for this change

lambda.Function.grantInvoke() throws an error when a ManagedPolicy or a Policy is passed.
It should add a policy statement to grant lambda:InvokeFunction on the policy document.

Description of changes

Implement IPrincipal directly on ManagedPolicy and Policy like Group.
policyFragment returns a dummy policy fragment and
PolicyStatment throws an error when a ManagedPolicy or a Policy is specified as principal or notPrincipal.

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Updated unit tests and integ tests to confirm grantInvoke() works.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.48%. Comparing base (e8e058c) to head (ef5f8fb).
Report is 8 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #32984   +/-   ##
=======================================
  Coverage   81.48%   81.48%           
=======================================
  Files         226      226           
  Lines       13768    13768           
  Branches     2416     2416           
=======================================
  Hits        11219    11219           
  Misses       2271     2271           
  Partials      278      278           

Flag	Coverage Δ
suite.unit	81.48% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	80.89% <ø> (ø)
packages/aws-cdk-lib/core	82.10% <ø> (ø)

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: ef5f8fb
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository