Inject "lambda:InvokeFunction" policy for SFN SMs

[kislyuk]

SFN SMs assume the same role as the Lambda itself.

Inject or assert the "lambda:InvokeFunction" IAM permission in the Chalice Lambda IAM role policy. Otherwise the resulting SM has no permission to invoke the Lambda.