(cli): Integrate with IAM Access Analyzer policy validation

Integrate IAM Access Analyzer policy validation with the CLI, either with a special command or during `deploy`.

It could also be used as a new "linting" tool in the repo to ensure that IAM policies created by AWS CDK constructs comply with best practices.

See https://aws.amazon.com/blogs/aws/iam-access-analyzer-update-policy-validation/
See https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-validation.html

### Use Case

* Warn users if their CDK code generates "bad" IAM policies
* Ensure AWS CDK constructs deliver IAM policies that are compliant with best practices

### Proposed Solution

To be discussed 😄

* [x] :wave: I may be able to implement this feature request
* [ ] :warning: This feature might incur a breaking change

---

This is a :rocket: Feature Request

Start with the IAM Access Analyzer policy validation documentation and the CLI's deploy flow, since the issue proposes either a dedicated command or deploy-time validation. Define the integration point, warning or failure behavior, and repository linting scope before implementation; done means CDK-generated IAM policies are checked against the selected validation path.

Written by the indexing model from the issue text.