cdk diff "expand"

Currently `cdk diff` will show full diff only for changed values. We should improve this to allow:

1. Not showing full diffs even for changed values
2. Showing full content for new values as well

Proposed API:

```
cdk diff --no-expand # show only a list of changed resources
cdk diff --expand=update
cdk diff --expand=new
cdk diff --expand=old
cdk diff --expand=all
```

I wonder if we should also allow people to opt out of emitting the IAM policy table in diffs (`--no-security-diff`). Perhaps `--mini` should imply `--no-security-diff` and `--no-expand`?

Start at the cdk diff command entry point and trace how changed values and IAM policy tables are currently rendered. Define the behavior for --no-expand and each --expand mode, including how --mini and --no-security-diff interact; done means the documented options produce the proposed diff views.

Written by the indexing model from the issue text.