[TON-707] Attach rendered instrumentation IAM policies

[fanny-jiang]

Note: Please remember to review the contribution guidelines
if you have not yet done so.

What does this PR do?

• requests rendered instrumentation policy_documents using the target AWS account and partition
• attaches the returned documents directly without client-side statement rendering, wrapping, or chunking
• checks the Datadog role managed-policy attachment quota before removing existing instrumentation policies
• follows the existing standard-integration cleanup, create, and attach pattern
• keeps the tested Python source synchronized with the Lambda embedded in datadog_integration_permissions.yaml

Motivation

Move IAM statement rendering and chunking into instrumenter-config, which owns the permission definitions, and keep the CloudFormation Lambda focused on attaching the resulting documents. The quota preflight prevents cleanup when the final document count cannot fit on the role.

Testing Guidelines

• python3 -B -S -m unittest discover -p "*_test.py" from aws_quickstart (56 tests)
• the test suite verifies that the embedded Lambda exactly matches attach_integration_permissions.py

Additional Notes

• depends on https://github.com/ddoghq/dd-source/pull/18715 and must be published only after the producer is deployed
• there is no fallback to legacy flat permissions; missing policy_documents is treated as an instrumentation failure
• ECS is intentionally unchanged and is not enabled in the UI
• EKS permission scope is intentionally unchanged; separate work will remove the EKS instrumenter Lambda
• bumps the QuickStart version to v4.16.0 and the policy attachment schema version to 2