IA-5062 fix: switch to using descendent roles instead of actions

[rtitle]

Ticket: https://broadworkbench.atlassian.net/browse/IA-5062

What:

#1543 added the leo_migration resource access policies to Sam. We think it was generating a lot of inserts by using descendent actions instead of roles, which was causing issues in Sam dev. Switching to roles to be more performant.

Why:

<For your reviewers' sake, please describe in ~1 paragraph what the value of this PR is to our users or to ourselves.>

How:

<For your reviewers' sake, please describe in ~1 paragraph how this PR accomplishes its goal.>

<If the PR is big, please indicate where a reviewer should start reading it (i.e. which file or function).>

---

PR checklist

• I've followed the instructions if I've made any changes to the API, especially if they're breaking changes
• I've filled out the Security Risk Assessment (requires Broad Internal network access) and attached the result to the JIRA ticket

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud