Add AWS IAM external trust attack dataset, updated Secrets Manager dataset

[themaryjo]

Summary

• Add an AWS CloudTrail dataset for successful IAM role creation with external-account or wildcard trust (T1098.003).
• Add an AWS EC2 startup script modification dataset (T1578.005).
• Update the AWS Secrets Manager batch retrieval dataset (T1555.006) to match the revised detection logic.

IAM dataset validation

• Confirmed both CloudTrail events parse as JSON Lines and their trust policies parse as JSON.
• Confirmed each returned role ARN matches the requested role name.
• Included two positive cases: an external AWS account principal and a wildcard AWS principal.

Testing

• Validated IAM dataset JSON Lines, role ARNs, and trust policies locally.
• Confirmed Git LFS objects uploaded with the branch.
• Confirmed repository ingestion and detection tests in CI.

[github-actions]

✅ Attack Data Validation Passed

All YAML files in this PR have been successfully validated against the schema.

Ready for review and merge! 🚀