Fix account management lambdas in v3.2

**Why?**

Issue: awslabs#728

With the latest Python runtime update provided by AWS Lambda, the boto3
dependencies were upgraded. However, with the account management Lambda
functions, the `aws-xray-sdk` requires botocore v1.29.54. This version
is incompatible with the latest boto3 package that was added to the Lambda
function runtime. Hence, it returned an error as described in 728.

**What?**

To ensure compatible versions are installed, ADF's lambda functions should
set the specific version of boto3 in its requirements.txt file if they rely on
that.

src/lambda_codebase/account_processing/requirements.txt

@@ -1,3 +1,5 @@
 aws-xray-sdk==2.11.0
+boto3==1.26.48
+botocore==1.29.48
 pyyaml>=5.4.1
 wrapt==1.14.1 # https://github.com/aws/aws-lambda-builders/issues/302

src/template.yml

@@ -923,15 +923,20 @@ Resources:
               - "organizations:DescribeOrganizationalUnit"
               - "organizations:ListParents"
               - "cloudformation:*"
-              - "iam:GetRole"
-              - "iam:PassRole"
-              - "iam:CreateRole"
-              - "iam:PutRolePolicy"
               - "organizations:DescribeOrganization"
               - "organizations:DescribeAccount"
               - "ssm:*"
               - "states:StartExecution"
             Resource: "*"
+          - Effect: "Allow"
+            Action:
+              - "iam:CreateRole"
+              - "iam:GetRole"
+              - "iam:PutRolePolicy"
+              - "iam:TagRole""
+            Resource:
+              - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${CrossAccountAccessRoleName}"
+              - !Sub "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${CrossAccountAccessRoleName}-readonly"
           - Effect: "Allow"
             Action: "s3:ListBucket"
             Resource: !GetAtt BootstrapTemplatesBucket.Arn