fix(infra): also authorise the SES configuration set on the staging task role

PR #280 added ses:SendRawEmail but kept the identity as the only resource. SES
authorises the configuration set separately, so the call stayed denied and only the
resource in the error message changed:

  before: not authorized ... on resource .../identity/kadicon.de
  after:  not authorized ... on resource .../configuration-set/my-first-configuration-set

The account sends through a default configuration set, which the SDK does not name
explicitly — it is attached on the SES side. The policy therefore has to list both ARNs.

Verified against the live policy and the staging log on 2026-09-06.