feat(ecs): allow specifying whether an imported task definition ARN includes a revision

[lemon0333]

Issue # (if applicable)

Closes #32485.

Reason for this change

fromFargateTaskDefinitionAttributes / fromEc2TaskDefinitionAttributes / fromTaskDefinitionAttributes cannot record whether an imported task definition ARN is fully-qualified (...:task-definition/family:123) or revision-less (...:task-definition/family).

When an EcsTask EventBridge target scopes down its ecs:RunTask permission (the case from #30390 / #31615), it must grant the exact ARN when a revision is present, or append a :* revision wildcard when it is not. Today that decision is made by string-inspecting the ARN:

if (!cdk.Token.isUnresolved(this.taskDefinition.taskDefinitionArn)) {
  const hasRevision = /:[0-9]+$/.test(this.taskDefinition.taskDefinitionArn);
  needsRevisionWildcard = !hasRevision;
}

This breaks when the ARN is only known at deploy time (e.g. Fn.importValue, or a CloudFormation parameter): the ARN is an unresolved token, so no revision can be inferred, and the :* wildcard is silently omitted even for a revision-less ARN. The maintainer (@ashishdhingra) confirmed this is a valid extension of #30390 / #31615.

Description of changes

• Added an optional, documented, jsii-friendly taskDefinitionArnIncludesRevision?: boolean to CommonTaskDefinitionAttributes (so TaskDefinitionAttributes, FargateTaskDefinitionAttributes, and Ec2TaskDefinitionAttributes all inherit it) in packages/aws-cdk-lib/aws-ecs/lib/base/task-definition.ts.
• Exposed it as an optional readonly property on the ITaskDefinition interface and threaded it through ImportedTaskDefinition and all three from*TaskDefinitionAttributes import methods.
• Consumed it in createEventRolePolicyStatements() in packages/aws-cdk-lib/aws-events-targets/lib/ecs-task.ts: when the flag is set it authoritatively decides whether the :* wildcard is needed; otherwise it falls back to the existing token/string inspection, so the default behavior is unchanged.

Public API shape

Per my note on the issue, the preferred shape wasn't specified, so I went with a boolean flag (taskDefinitionArnIncludesRevision) rather than a separate no-revision ARN field, because it maps directly onto the single decision the grant logic makes and keeps the import surface minimal. I'm happy to rename it or switch to a separate field if a maintainer prefers a different shape — feedback welcome.

Describe any new or updated permissions being added

No new permissions. This changes how the resource scope of the existing ecs:RunTask permission is computed for the EventBridge EcsTask target: a revision-less imported ARN whose value is a deploy-time token is now correctly scoped with a :* revision wildcard when taskDefinitionArnIncludesRevision: false is supplied.

Description of how you validated changes

• Unit tests — added 3 tests in aws-events-targets/test/ecs/event-rule-target.test.ts (tokenized ARN + false -> :* wildcard; tokenized ARN + true -> ARN as-is; concrete ARN with explicit override) and 1 test in aws-ecs/test/fargate/fargate-task-definition.test.ts (attribute is recorded / defaults to undefined). Full suites pass: 39/39 (events-targets ecs) and 67/67 (ecs task-definition).
• Integ test — updated integ.ecs-imported-task-def (which imports a family-only ARN built from region/account tokens) to set taskDefinitionArnIncludesRevision: false, and regenerated the snapshot. The only functional snapshot change is the ecs:RunTask resource going from .../task-definition/TaskDefinitionA to .../task-definition/TaskDefinitionA:*.
• Build — tsc compiles the affected packages with 0 errors.
• README — documented the new attribute under "Run an ECS Task" in aws-events-targets/README.md.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license