Fleet provisioning CFN template refinement

[gregbreen]

Issue #, if available:

None

Description of changes:

1. Minimize token exchange role access. Just the minimum for system log forwarder, and pulling artifacts from S3.
2. Use the least-privilege fleet provisioning IoT policy as documented here: https://docs.aws.amazon.com/iot/latest/developerguide/provision-wo-cert.html#claim-based
3. Use least-privilege iot:Connect resource in the provisioned IoT policy. The other actions remain as wildcards since we don't know what topics they might use.
4. Remove unused actions and resource from the MAC Validation Lambda role.
5. Fleet prov template: provision with exclusive thing association since it's a best practice.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[thomas-roos]

thank you!