Add additional_policies variable to agent IAM module

[agustincelentano]

Summary

• Add additional_policies variable (map(string), default {}) to the agent IAM module
• Use merge() to combine base policies with additional ones passed by consumers
• Fully backward compatible, no changes needed for existing consumers

Test plan

• Verify tofu plan with no additional_policies set (should show no changes)
• Verify tofu plan passing extra policy ARNs via additional_policies