awscc - update action - ensure patch only against updatable properties

[kapilt]

closes #9296

[ajkerrigan]

Just a question inline around the need for deepcopy, otherwise lgtm once checks are passing 👍

[ajkerrigan]

This looks good to me, thanks! 🎉

Two things I was noodling on were:

• Would this make more sense as a separate patch action?
  • Probably not
• Can we make this a bit more streamlined for policy authors rather than exposing full/explicit jsonpatch syntax?
  • Maaaybe, but the cost would be making things less obvious or too magical, particularly for the op: remove case

[kapilt]

@ajkerrigan I think you answered your own questions ;-) but let me know if you want some additional context. fwiw, we might need to extend this action in the future to take into consideration in flight operations to the resources.