Add acm:ExportCertificate to IAM policy for adopted cert export

Required for exportTo to work with adopted certificates. This permission
only reads existing cert data (cert body + private key), does not create
new certificates.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sanmesh-kakade

modules/ack_acm_controller/legacy/1.0/main.tf

@@ -47,6 +47,7 @@ resource "aws_iam_policy" "ack_acm" {
         Effect = "Allow"
         Action = [
           "acm:DescribeCertificate",
+          "acm:ExportCertificate",
           "acm:GetCertificate",
           "acm:ListCertificates",
           "acm:ListTagsForCertificate",