…riables

When creating a CodeBuild Project that uses environment variables from SecretsManager,
the Project fails execution with:

```
AccessDeniedException: User: arn:aws:sts::828671620168:assumed-role/role
is not authorized to perform: secretsmanager:GetSecretValue on resource:
arn:aws:secretsmanager:us-west-2:123456789012:secret:my-secret-GXyUCE
```

The solution is to automatically grant the Project's Role permissions to read all
Secrets whose names were provided as environment variables.