Sandbox packaging can't get deployment bucket to policy statement

Issue description

When packaging serverless app that has both container Lambdas and MicroVM, created CloudFormation template doesn't contain bucket name in policy statment.

Source: https://github.com/serverless/serverless/blob/ba6ba66c01ae3cbb5f6ae458ea12e3814b815ba0/packages/serverless/lib/plugins/aws/sandboxes/iam/policies.js#L153-L163

Generated statement:

                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:GetObject"
                  ],
                  "Resource": {
                    "Fn::Sub": "arn:${AWS::Partition}:s3:::undefined/*"
                  }
                }

Package itself "knows" bucket, as in MicroVM resource has:

        "CodeArtifact": {
          "Uri": {
            "Fn::Sub": [
              "s3://${B}/serverless/my-cyber/dev/sandboxes/sync_all_vulndb_vulnerabilities-17d07c049af6bb929ebeb877a79c06067112c38671be351fd19a16ec5f53e1d7.zip",
              {
                "B": {
                  "Ref": "ServerlessDeploymentBucket"
                }
              }
            ]
          }
        }

For CodeArtifact code is generated at: https://github.com/serverless/serverless/blob/main/packages/serverless/lib/plugins/aws/sandboxes/compilation/orchestrator.js#L171-L174

Role is coming from: https://github.com/serverless/serverless/blob/main/packages/serverless/lib/plugins/aws/sandboxes/compilation/orchestrator.js#L263-L269

Latter should use same bucket.

Context

When trying to generate packages for examples (https://github.com/serverless/examples/tree/v4/sandboxes) buckets get correctly to the generated CloudFormation.