(assertions): simple way to write tests on IAM policies

Right now, writing tests on IAM policies looks a lot like this:

```ts
bucket.grantRead(lambda);

expect(pipelineStack).toHaveResourceLike('AWS::IAM::Policy', {
PolicyDocument: {
Statement: arrayWith(deepObjectLike({
Action: ['s3:GetObject*', 's3:GetBucket*', 's3:List*'],
Resource: ['arn:aws:s3:::ThisParticularBucket', 'arn:aws:s3:::ThisParticularBucket/*'],
})),
},

// Missing: Roles: [ { Ref: 'MyRoleAsdf13254658' } ],
});
```

This is a lot of hassle to type every time, and is not really complete. It's also not checking that the Lambda has the right Role, and that the Role has the right permissions.

Since this kind of IAM permissions testing is very common, it would be nice if the assertions library had some convenient primitives for it.

### Proposed Solution

What would it look like? Maybe something like:

```ts
expect(lambda).toHaveIamPermission({
Action: ['s3:GetObject*', 's3:GetBucket*', 's3:List*'],
Resource: ['arn:aws:s3:::ThisParticularBucket', 'arn:aws:s3:::ThisParticularBucket/*'],
});
```

Abstracting over the Role and the PolicyDocument.

* [ ] :wave: I may be able to implement this feature request
* [ ] :warning: This feature might incur a breaking change

---

This is a :rocket: Feature Request

No file or test is named. Start from the proposed `toHaveIamPermission` entry point and the existing `toHaveResourceLike` example, then inspect the assertions library's IAM role and policy handling. Done means the assertion can verify the shown S3 actions and resources through the Lambda's role and policy without manually traversing `AWS::IAM::Policy`.

Written by the indexing model from the issue text.