Amplify PR environments override S3 access policies for the `Authenticated role` in an imported Identity Pool

### Before opening, please confirm:

- [X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-cli/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

v16.9.1

### Amplify CLI Version

7.6.25

### What operating system are you using?

macOS 12.2.1 (21D62)

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No. We use imported Cognito User and Identity Pools.

### Amplify Categories

auth, storage

### Amplify Commands

Not applicable

### Describe the bug

Amplify PR environments override S3 access policies for the `Authenticated role` in an imported Identity Pool.

Amplify CLI version: 7.6.25

Amplify replaces the bucket name in all ARNs with the PR env bucket name when creating the PR environments. It should not change the bucket name in the policy but instead append a new item to the "Resource" array.

Policies affected:

Private_policy_*
Protected_policy_*
Public_policy_*
read_policy_*
Uploads_policy_*

As it is, all PR environments will override the S3 access policies for the imported ID Pools ` Authenticated role`.

Relevant AWS documentation:

https://docs.amplify.aws/cli/auth/import/#import-an-existing-identity-pool

```
Amplify CLI will update the policies attached to the roles to ensure Amplify categories function correctly. For example, enabling Storage for authenticated & guest users will add private, protected, public, read and upload permissions for the S3 bucket to the unauthenticated & authenticated role.
```

### Expected behavior

It should not change the bucket name in the policy but instead append a new item to the "Resource" array.

### Reproduction steps

• Create a User Pool
• Create an Identity Pool with the new user pool as an authentication provider.
• Run `amplify import auth` and import the User and ID Pools.
• Create a `dev` environment.
• Add storage to the environment and take note of the bucket name.
• Require authenticated access to storage.
• Push the `dev` environment.
• Turn on PR environments.
• Turn on Amplify continuous deployment for the `dev` environment and perhaps the `main` branch.
• Make some code changes and raise PR in GitHub.
• Merge the PR to `main`.
• When the PR environment is created, it will override the bucket name in the imported identity pool's `Authenticated role` S3 access policies. E.g. it will no longer use the original storage bucket specified when adding storage to Amplify but instead use the bucket created for the PR environment.

### GraphQL schema(s)

```graphql
# Put schemas below this line

```

### Log output

```
# Put your logs below this line

```

### Additional information

_No response_