fix: grant testing account access to sandbox layers (#1141)

## Summary
- Sandbox layers were published without any resource-based permissions,
blocking the self-monitoring account (`093468662994`) from accessing dev
layer versions during CDK deployments.
- When `ADD_LAYER_VERSION_PERMISSIONS=0` (sandbox), the publish script
now grants `lambda:GetLayerVersion` to the testing account instead of
leaving the layer inaccessible.

## Test plan
- [ ] Trigger a sandbox layer publish and verify the layer version has a
resource-based policy for `093468662994`
- [ ] Deploy `lmi-dev-agent` stack in self-monitoring repo using
`ENVIRONMENT=dev` (pulls from `layers-dev.json` / sandbox account
`425362996713`)

Author: duncanista

.gitlab/scripts/publish_layers.sh

@@ -50,7 +50,7 @@ publish_layer() {
         | jq -r '.Version'
     )
 
-    # Add permissions only for prod
+    # Add permissions: public for prod, grant testing account access to sandbox layers
     if [ "$ADD_LAYER_VERSION_PERMISSIONS" = "1" ]; then
         permission=$(aws lambda add-layer-version-permission --layer-name $layer \
             --version-number $version_nbr \
@@ -59,6 +59,14 @@ publish_layer() {
             --principal "*" \
             --region $region
         )
+    else
+        permission=$(aws lambda add-layer-version-permission --layer-name $layer \
+            --version-number $version_nbr \
+            --statement-id "release-$version_nbr" \
+            --action lambda:GetLayerVersion \
+            --principal "093468662994" \
+            --region $region
+        )
     fi
 
     echo $version_nbr