fix(stepfunctions-tasks): scope down BatchSubmitJob permissions to specific job definition

[syukawa-gh]

Closes #37214
The SubmitBatchJob task was granting batch:SubmitJob on all job definitions (job-definition/*). Now uses the specific jobDefinitionArn when available.
Exemption Request: IAM policy change, covered by existing unit tests.

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[syukawa-gh]

Exemption Request: This fix scopes down BatchSubmitJob IAM permissions to the specific job definition ARN. Unit tests are included. Integration test snapshot update is needed — will add.

[syukawa-gh]

Correction to my previous comment: After reviewing the diff more carefully, this PR needs unit tests to be added. I will update this PR with the required tests. The Exemption Request above should be disregarded for the unit test requirement.

[syukawa-gh]

To clarify my earlier comments: unit tests are already included in this PR. The "Correction" comment above was posted in error. The exemption request is for the integration test only — this is an IAM policy scope-down change, and the unit test verifies the correct resource ARNs in the generated policy statement.

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	24 ran	24 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	24 ran	24 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates