fix: Add ssm:GetParameters permission to external-secrets policy

[amarkevich]

https://docs.aws.amazon.com/systems-manager/latest/userguide/integrating_csi_driver.html#integrating_csi_driver_access

Description

according to documentation ssm:GetParameters permission is required

Motivation and Context

atm AWS CSI Secret Store Driver failed to get parameter with error
MountVolume.SetUp failed for volume "volume_name" : rpc error: code = Unknown desc = failed to mount secrets store objects for pod namespace/pod-647dbc98b4-h8kl4, err: rpc error: code = Unknown desc = Failed fetching parameters: WebIdentityErr: failed to retrieve credentials caused by: AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity status code: 403, request id: request-uuid

Breaking Changes

How Has This Been Tested?

• use https://github.com/aws/secrets-store-csi-driver-provider-aws
• attach_external_secrets_policy = true; external_secrets_ssm_parameter_arns = ["cluster-oidc-provider-arn"]
• Deployment spec: specify serviceAccountName with

    annotations = {
      "eks.amazonaws.com/role-arn" = module.secrets-store-csi-irsa-role.iam_role_arn
    }

• mount SecretProviderClass with provider: aws

[antonbabenko]

This PR is included in version 5.9.1 🎉

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.