fix: add cloudwatch_log_group_principals variable to fix IAM trust policy

Fixes #35

## Problem
The module uses the cloudposse/cloudwatch-logs/aws module which defaults
to ec2.amazonaws.com as the principal service for the IAM role trust policy.
This is incorrect for API Gateway and causes deployment failures.

## Solution
Add a cloudwatch_log_group_principals variable that:
- Accepts a map of service principals for the CloudWatch Logs IAM role
- Defaults to apigateway.amazonaws.com (the correct principal)
- Passes through to the cloudwatch-logs module

## Impact
- Fixes API Gateway deployments with CloudWatch logging enabled
- Backward compatible - uses sensible default
- Allows overriding principals if needed for specific use cases

## Testing
Existing tests should pass as they now use the correct IAM principal.
The complete example creates an API Gateway with logging enabled and
verifies successful deployment.

Author: ZephAtLife360

main.tf

@@ -33,6 +33,7 @@ module "cloudwatch_log_group" {
   enabled              = local.create_log_group
   iam_tags_enabled     = var.iam_tags_enabled
   permissions_boundary = var.permissions_boundary
+  principals           = var.cloudwatch_log_group_principals
 
   context = module.this.context
 }

variables.tf

@@ -151,3 +151,11 @@ variable "throttling_rate_limit" {
   type        = number
   default     = -1
 }
+
+variable "cloudwatch_log_group_principals" {
+  description = "Map of service principals allowed to assume the CloudWatch Logs IAM role. Defaults to apigateway.amazonaws.com to fix the incorrect ec2.amazonaws.com default from the cloudwatch-logs module."
+  type        = map(list(string))
+  default = {
+    Service = ["apigateway.amazonaws.com"]
+  }
+}