[cloud][test]Add missing IAM policy for cloudfront (#38248)

Cloudfront needs CreateOriginAccessIdentity

Add profile parameter to setup-iam.yml. Could arguably just use
AWS_PROFILE but given that other tasks are using profile, should
be consistent.

hacking/aws_config/setup-iam.yml

@@ -26,6 +26,7 @@
 
     - name: Get aws account ID
       aws_caller_facts:
+        profile: "{{ profile|default(omit) }}"
       register: aws_caller_facts
 
     - name: Set aws_account_fact

hacking/aws_config/testing_policies/cloudfront-policy.json

@@ -7,6 +7,7 @@
             "Action": [
                 "cloudfront:CreateDistribution",
                 "cloudfront:CreateDistributionWithTags",
+                "cloudfront:CreateCloudFrontOriginAccessIdentity",
                 "cloudfront:DeleteDistribution",
                 "cloudfront:GetDistribution",
                 "cloudfront:GetStreamingDistribution",