DDLS-425 restrict management ci to limited access

[jamesrwarren]

Purpose

restrict management ci to limited access to digideps resources on management account

Fixes DDLS-425

Approach

In event of security breach, this will stop any attacker being able to affect the DNS/secrets etc of other products that use the management account.

I have created a new policy in org infra and this PR uses that policy.

Once we're sure this works we need to remove the original management CI user completely and just use this one.

Learning

NA

Checklist

• I have performed a self-review of my own code
• I have updated documentation (Confluence/ADR/tech debt doc) where relevant
• I have added tests to prove my work
• The product team have approved these changes
• I have checked my work for potential security issues and refered to the OWASP top 10

Frontend

• I have run an in-browser accessibility test (e.g. WAVE, Lighthouse)
• There are no deprecated CSS classes noted in the profiler
• Translations are used and the profiler doesn't identify any missing
• Any links or buttons added are screen reader friendly and contextually complete
• If adding GA events, I have updated or checked the existing category or label values