Stack Policy support for resource properties

## Scope

I'd like to create stack policies that can allow or deny resource updates based on the properties changed.

## Use case

I have a CloudFormation-managed CloudFront distribution that is a mission-critical, 24/7 service. Currently, the stack policy completely denies updates to the resource. This allows our team to deploy changes to the rest of the stack via CI with confidence that they won't break the distribution.

```json
{"Statement":[{"Effect":"Allow","Action":"Update:*","Principal":"*","NotResource":"LogicalResourceId/CloudFront"}]}
```

However, I want to give our team a switch for real time logs. That's a safe change, because it won't affect customers.

It would be seriously helpful if I could use a stack policy to allow changes to the `DistributionConfig::DefaultCacheBehavior::RealtimeLogConfigArn` or `DistributionConfig::CacheBehaviors[]::RealtimeLogConfigArn` properties, while denying any other changes to the resource.

Perhaps a `ResourceProperty` condition that takes a JMESPath / JSONPath representation of the property?

No repository files, tests, or entry points are identified; begin by reviewing the stack-policy behavior described in the issue and the CloudFormation property paths in the examples. Done means defining how property-level allow/deny matching should be expressed and how permitted and blocked resource updates should behave.

Written by the indexing model from the issue text.