fix: Work around limit in lambda policy size

[zbstof]

There's limit on the policy size (20KB) for lambda policy

Currently failing with

│ Error: adding Lambda Permission (arn:aws:lambda:us-east-2:591234544403:function:model-inference-development-datadog-forwarder/_aws_sagemaker_Endpoints_recs-ranker-rn-scribd-has-read-after-AllowExecutionFromCloudWatchLogs): PolicyLengthExceededException: The final policy size (20782) is bigger than the limit (20480).
│ {
│   RespMetadata: {
│     StatusCode: 400,
│     RequestID: "e220c7fb-c4c9-4b93-9f15-beba592a3afc"
│   },
│   Message_: "The final policy size (20782) is bigger than the limit (20480).",
│   Type: "User"
│ }
│
│   with module.datadog[0].aws_lambda_permission.allow_cloudwatch_logs_to_call_dd_lambda_handler["/aws/sagemaker/Endpoints/recs-ranker-rn-scribd-has-read-after"],
│   on .terraform/modules/datadog/logs_monitoring_cloudwatch_log.tf line 10, in resource "aws_lambda_permission" "allow_cloudwatch_logs_to_call_dd_lambda_handler":
│   10: resource "aws_lambda_permission" "allow_cloudwatch_logs_to_call_dd_lambda_handler" {
}

Current size of lambda policy:

$ aws lambda get-policy --function-name model-inference-development-datadog-forwarder | jq -r '.Policy' | wc
       1       1   20090

[xianwill]

@zbstof This issue seems to indicate wildcards may not work as expected here. Also, logically, this seems to become a full grant to all cloudwatch groups in the AWS account rather than explicit permissions for specific log groups which smells funny.