Add support for iamRoles filtering for Service Catalog

[jeffb4]

Currently, the pipeline catalog (mu catalog) supports a list of iamUsers which are added to a group that has permission to access Service Catalog mu portfolios.

Add the ability to add iamRoles, because SSO-based AWS users might not have a direct IAM user assigned to them.