## Problem
Currently, even if `LAMBDA_REMOTE_DOCKER=1`, we unzip the zip files in the directory they are in, which is usually /var/lib/localstack, which usually has a bind mount to the host.
On docker desktop, due to the use of grpc-FUSE (on macos), this can be very slow, about 200 times slower than on volumes / directly on the host. With experimental virtio filesystem enabled (also on macos), this can be reduced to about 30 times as slow, but still problematic.
This means a lambda may take a lot of time processing, for each additional layer some more. This especially affects nodejs lambdas with huge node_modules folders.

## Probable solution
At least if `LAMBDA_REMOTE_DOCKER=1`, we should leave the initial zip files on the bind mount (for persistence etc), but the working directories after unzipping should be located on non-bind mounts, to speed up the IO for unzipping.
iam_client = aws_stack.connect_to_service("iam")
    sid = data.get("StatementId")
    action = data.get("Action")
    principal = data.get("Principal")
    sourcearn = data.get("SourceArn")
    previous_policy = get_lambda_policy(resource_name, qualifier)
    if resource_arn not in region.lambdas:
        return not_found_error(resource_arn)
    if not re.match(r"lambda:[*]|lambda:[a-zA-Z]+|[*]", action):
        msg = (
            f'1 validation error detected: Value "{action}" at "action" failed to satisfy '
            "constraint: Member must satisfy regular expression pattern: "
            "(lambda:[*]|lambda:[a-zA-Z]+|[*])"
        )
        return error_response(msg, 400, error_type="ValidationException")
    new_policy = generate_policy(sid, action, resource_arn_qualified, sourcearn, principal)
    new_statement = new_policy["Statement"][0]
    result = {"Statement": json.dumps(new_statement)}
    if previous_policy:
        statment_with_sid = next(
            (statement for statement in previous_policy["Statement"] if statement["Sid"] == sid),
            None,
        )
        if statment_with_sid and statment_with_sid == new_statement:
            LOG.debug(
                f"Policy Statement SID '{sid}' for Lambda '{resource_arn_qualified}' already exists"
            )
            return result
        if statment_with_sid:
            msg = (