Scope IAM resource collection policy names to role name

[raymondeah]

Summary

• Scopes managed IAM policy names to the integration role name to prevent EntityAlreadyExists errors when re-creating CloudFormation stacks
• Extracts _detach_and_delete_policy helper to reduce duplication in cleanup logic
• Applies the same fix to both attach_integration_permissions.py and the inline Lambda in datadog_integration_role.yaml

Problem

The Lambda that attaches resource collection permissions uses hardcoded policy names like datadog-aws-integration-resource-collection-permissions-1. These names are global per AWS account. When a stack is deleted and re-created:

1. cleanup_existing_policies tries to detach + delete old policies
2. If detach fails silently (e.g. policy still attached to another entity), delete throws DeleteConflictException which is only logged as a warning
3. create_policy then fails with EntityAlreadyExists because the old policy wasn't deleted

Fix

Include the IAM role name in policy names:

# Before
datadog-aws-integration-resource-collection-permissions-1

# After
datadog-aws-integration-resource-collection-permissions-DatadogIntegrationRole-1

Since IAM role names are unique per AWS account, this guarantees policy name uniqueness per integration. The existing wildcard ARN in the Lambda execution role (policy/datadog-aws-integration-resource-collection-permissions-*) already covers any suffix.

Risk

None. This was introduced in PR #250 and has not been released in Datadog UI yet.

Test plan

• Deploy stack with ResourceCollectionPermissions=true, verify policies created with role-scoped names
• Delete stack, verify policies cleaned up
• Re-create stack with same role name, verify no EntityAlreadyExists error
• Verify with custom IAMRoleName parameter

[raymondeah]

drive-by add here