feat: add task-role-arn and execution-role-arn inputs

[s3cube]

Summary

• Adds task-role-arn and execution-role-arn optional inputs to dynamically set taskRoleArn and executionRoleArn on the rendered task definition
• Includes ARN format validation (regex) supporting all AWS partitions: aws, aws-cn, aws-us-gov, aws-iso, aws-iso-b, aws-iso-e, aws-iso-f
• Sets role ARNs at the task definition level (not container level), matching the ECS API schema

Closes #378, closes #183

Motivation

Users need to pass IAM role ARNs via GitHub Secrets rather than hardcoding them in task definition JSON files (security concern raised in #183). This also addresses the review feedback on PR #372 which requested ARN validation.

Test plan

• Existing tests updated with new mock positions for the two additional getInput calls
• New tests: task role ARN only, execution role ARN only, both together
• New tests: role ARN with path prefix (/path/to/role)
• New tests: aws-cn partition ARN
• New tests: invalid ARN format (garbage string, wrong service, short account ID)
• Verify npm test passes locally
• Verify npm run package rebuilds dist/ cleanly