chore(network-connector): switch OperatorRole to managed policy and fill sam-docs descriptions

[licjun]

Issue #, if available

N/A

Description of changes

1. NetworkConnector OperatorRole: Replace the inline policy with AWSLambdaNetworkConnectorOperatorPolicy AWS managed policy for the auto-generated OperatorRole, aligning with how CapacityProvider handles its operator role.

2. sam-docs.json: Fill in property descriptions for MicrovmImage, NetworkConnector, and WebSocketApi resources (previously TODO).

Description of how you validated changes

• Unit tests: make pr passed (4617 tests, 95.63% coverage)
• Integration tests: test_basic_network_connector passed against us-east-2

Checklist

• Review the generative AI contribution guidelines
• Adheres to the development guidelines
• Add/update transform tests
  • Using correct values
  • Using wrong values
• Add/update integration tests

Examples?

N/A

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[aws-sam-tooling-bot]

Code Review Results

Reviewed: da148ea..289f9ea
Files: 15
Comments: 2

[aws-sam-tooling-bot]

Code Review Results

Reviewed: da148ea..d6b8532
Files: 15
Comments: 1

[aws-sam-tooling-bot]

Code Review Results

Reviewed: da148ea..bd5f6d8
Files: 15
Comments: 1

---

Comments on lines outside the diff:

[samtranslator/internal/schema_source/sam-docs.json:1006] [BUG] The new VpcConfig description under sam-resource-networkconnector states that AWS SAM injects AssociatedComputeResourceTypes: [MicroVM] automatically, but the actual value injected by samtranslator/model/network_connector/generators.py (and reflected in every tests/translator/output/network_connector.json) is "MicroVm" (lower‑case m), not "MicroVM":

"AssociatedComputeResourceTypes": ["MicroVm"],

Update the description to match the value the transform actually emits (e.g. AssociatedComputeResourceTypes: [MicroVm]) so users comparing the docs to generated CFN don't hit a confusing mismatch. The same wording appears in the corresponding markdownDescription in samtranslator/schema/schema.json and schema_source/sam.schema.json and should be updated in all three places.

Note on prior review comments: the three earlier bugs flagged on sam-docs.json (Logging.Disabled type, CpuConfiguration.Architecture valid values, Hooks.Port required) have all been correctly addressed in the current diff. The NetworkConnectorGenerator refactor to use construct_role_for_resource with AWSLambdaNetworkConnectorOperatorPolicy mirrors the CapacityProvider pattern, produces correctly partitioned ARNs (aws, aws-cn, aws-us-gov) in the snapshot outputs, and preserves the passthrough_resource_attributes and SAM tag behavior.