Allow passing SCPs on an Account level

[rehanvdm]

Currently, complete SCPs can not be specified by the caller, they can only provide arguments for denyServiceList that will internally construct the SCP. There can only be 5 SCPs and I think 2 or three might already be allocated

aws-data-landing-zone/src/stacks/organization/management-stack.ts

Line 123 in dfe6f6d

workloadAccountsOrgPolicies() {

So maybe we can add some extra validation to catch that early on. Also mentioned that they will have to exclude the ControlTower role

aws-data-landing-zone/src/constructs/organization-policies/service-control-policy.ts

Line 34 in cd54815

conditions: excludeCtRoles,