Fix CFN execution role transform permission and pip install path

- Add cloudformation:CreateChangeSet on aws:transform/* to the shared
  CFN execution role (required for SAM's Serverless transform)
- Remove working-directory from pip install step so it finds
  requirements.txt at repo root (not just cdk-dir)

.github/workflows/cd-cdk.yaml

@@ -57,7 +57,6 @@ jobs:
 
       - name: Install Python dependencies
         if: ${{ inputs.python-version != '' }}
-        working-directory: ${{ inputs.cdk-dir }}
         run: |
           for req in $(find . -name requirements.txt -not -path '*/node_modules/*'); do
             pip install -r "$req"

oidc-deploy-roles.yaml

@@ -54,6 +54,16 @@ Resources:
         - arn:aws:iam::aws:policy/AmazonEventBridgeFullAccess
         - arn:aws:iam::aws:policy/AmazonSESFullAccess
         - arn:aws:iam::aws:policy/IAMFullAccess
+      Policies:
+        - PolicyName: cloudformation-transforms
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action:
+                  - cloudformation:CreateChangeSet
+                Resource:
+                  - arn:aws:cloudformation:us-east-1:aws:transform/*
 
   # ---------------------------------------------------------------------------
   # SAM deploy roles (5 repos)