Add lambda:ListTags permission to ProvisionPublishEgressIP policy

[dav3r]

🗣 Description

This PR adds the lambda:ListTags permission to the ProvisionPublishEgressIP policy.

💭 Motivation and context

We want to maintain our current level of functionality.

AWS Support writes:

Previously, permissions on ListTags were required only when using the ListTags API explicitly. However, principals with GetFunction API permissions could still access tag information outputted by the GetFunction call even if there is an explicit deny on ListTags API. Beginning October 2, 2024, Lambda will return tags data only when the principal calling GetFunction API has a policy with an explicit allow permission on ListTags API. When the role calling the GetFunction API has a policy with a deny or has no policy with explicit allow access to ListTags API, Lambda will not return tags data in the response to the GetFunction API call.

For reference: https://docs.aws.amazon.com/lambda/latest/dg/configuration-tags.html#permissions-required-for-working-with-tags-cli

🧪 Testing

👀

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All new and existing tests pass.