fix: allow OIDC ECR role to pull images (#1446)

Update the OIDC ECR role's permission policy to
allow it to pull images as well.

This is needed for the Docker SBOM workflow step.

infrastructure/terragrunt/aws/ecr/oidc.tf

@@ -32,11 +32,17 @@ data "aws_iam_policy_document" "ecr_push" {
   statement {
     effect = "Allow"
     actions = [
+      "ecr:BatchCheckLayerAvailability",
+      "ecr:BatchGetImage",
       "ecr:CompleteLayerUpload",
-      "ecr:UploadLayerPart",
+      "ecr:DescribeImages",
+      "ecr:DescribeRepositories",
+      "ecr:GetDownloadUrlForLayer",
+      "ecr:GetRepositoryPolicy",
       "ecr:InitiateLayerUpload",
-      "ecr:BatchCheckLayerAvailability",
-      "ecr:PutImage"
+      "ecr:ListImages",
+      "ecr:PutImage",
+      "ecr:UploadLayerPart"
     ]
     resources = [
       aws_ecr_repository.wordpress.arn