Fine-grained s3 access control for cognito user groups

### Before opening, please confirm:

- [X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-cli/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

### How did you install the Amplify CLI?

_No response_

### If applicable, what version of Node.js are you using?

_No response_

### Amplify CLI Version

4.52.0

### What operating system are you using?

Mac

### Amplify Categories

storage

### Amplify Commands

update

### Describe the bug

7-8 months ago I had created an S3 bucket through the amplify CLI. Recently I wanted to update the settings for the bucket and noticed that the template that was generated had group policies what did not restrict access to /public like they did before. Now they allow access to the entire bucket by default.

Here's an example of a cognito group policy that was generated before (must be 7 months ago or more) vs now:

Old Version:
```

"orgManagerGroupPolicy": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyName": "orgManager-group-s3-policy",
"Roles": [
{
"Fn::Join": [
"",
[
{
"Ref": "authcognitoUserPoolId"
},
"-orgManagerGroupRole"
]
]
}
],
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
{
"Fn::Join": [
"",
[
"arn:aws:s3:::",
{
"Ref": "S3Bucket"
},
"/public/*"
]
]
}
]
},
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": [
{
"Fn::Join": [
"",
[
"arn:aws:s3:::",
{
"Ref": "S3Bucket"
}
]
]
}
]
}
]
}
}
},
```

New Version:
```

"orgManagerGroupPolicy": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyName": "orgManager-group-s3-policy",
"Roles": [
{
"Fn::Join": [
"",
[
{
"Ref": "authcognitoUserPoolId"
},
"-orgManagerGroupRole"
]
]
}
],
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
{
"Fn::Join": [
"",
[
"arn:aws:s3:::",
{
"Ref": "S3Bucket"
},
"/*"
]
]
}
]
},
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": [
{
"Fn::Join": [
"",
[
"arn:aws:s3:::",
{
"Ref": "S3Bucket"
}
]
]
}
]
}
]
}
}
},
```

The only difference is the removal of "/public" in the resource.

This allows members of the specified Cognito group to be able to read anything in the bucket. My understanding is that the amplify philosophy was prescribing a public private and protected prefixes and by default users were allowed to write under private/cognito:sub. This seems to be broken now and is introducing security risks.

### Expected behavior

By default users should not be given access to the entire bucket but only two keys with the prefix of `public`

### Reproduction steps

roll back to a version of the CLI that's 8 months old
create a new project and add an S3 bucket
Update the to latest and modify the S3 bucket configuration through the amplify cli

### GraphQL schema(s)

```graphql
# Put schemas below this line

```

### Log output

```
# Put your logs below this line

```

### Additional information

_No response_