AWS::Logs::LogGroup !GetAtt LogGroup.Arn returns the wrong value

## 1. Title

AWS::Logs::LogGroup
Fn::GetAtt Arn

## 2. Scope of Request

The resource currently returns `Arn` through `GetAtt` but the value of this returned variable does not follow the ARN format posted [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncloudwatchlogs.html#amazoncloudwatchlogs-resources-for-iam-policies). Currently it returns `arn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}:*`. The extra `:*` appended to the return value means that it cannot be used in IAM policies or anywhere else that requires a clean CloudWatchLogs LogGroup ARN.

## 3. Expected Behaviour

`!GetAtt LogGroup.Arn` should return an ARN in the format `arn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}`

## 4. Suggested Test Cases

Given a `LogGroup` resource, use it in an IAM policy like so and run the policy simulator or a Lambda function to verify that logs are being written to the log group:
```json
Policy:
Type: "AWS::IAM::Policy"
Properties:
PolicyName: "allow-lambda-logging"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- logs:CreateLogStream
- logs:PutLogEvents
Resource:
- !GetAtt LogGroup.Arn
- !Sub
- "${Arn}:log-stream/*"
- Arn: !GetAtt LogGroup.Arn
Roles:
- !Ref LambdaRole
```

## 5. Helpful Links

* CFN documentation showing the incorrect ARN format: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-loggroup.html#aws-resource-logs-loggroup-return-values
* Official ARN format: https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncloudwatchlogs.html#amazoncloudwatchlogs-resources-for-iam-policies

## 6. Category

Management