Support complex permissions

Currently, the `permissions` model only supports action-based permissions with no additional scope. I propose the addition of a complex permissions set such as:

```
{
"typeName": "Foo::Bar::Baz",
...
"handlers": {
"create": {
"complexPermissions": [
{
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:List*"
],
"Resource": [
"arn:aws:s3:::limited*",
"arn:aws:s3:::otherlimited*"
],
"Condition": [
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"dynamodb.amazonaws.com"
]
}
],
"Effect": "Allow"
},
{
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:List*"
],
"NotResource": [
"arn:aws:s3:::limited*"
],
"Effect": "Deny"
},
...
]
},
...
}
}
```

Labels: enhancement

Start by locating the permissions model and its handler representation; compare the current action-only shape with the proposed complexPermissions entries. Clarify how Action, Resource, Condition, NotResource, and Effect should be represented before implementation. Done requires an accepted schema change covering the example.

Written by the indexing model from the issue text.