(aws-s3): support `Bucket.fromLookup` method

### Describe the bug

I have multiple cloudfront distributions and need use a unique bucket for them so i need have a pre existent bucket to conceed permission by folder path at my 'shared' s3 bucket.

I need to get a policy from an existing bucket, but a `.policy` property always returns `undefined`.

My case is needs retrieve the bucket policy to add a new statement dynamically.

So, with the property always coming undefined, it is not possible to know when a bucket has a bucket policy or not.

### Expected Behavior

The AWS SDK have `GetBucketPolicyCommand` and returns current bucketPolicy with success.
AWS CDK needs same feature/behavior.

### Current Behavior

Bucket.fromBucketName(...).policy equals `undefined` always.

### Reproduction Steps

1 - cdk init --language=typescript

2 - the code
```ts
import { App, Stack } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { Bucket, BucketPolicy, IBucket } from 'aws-cdk-lib/aws-s3';
import { CanonicalUserPrincipal, PolicyStatement } from 'aws-cdk-lib/aws-iam';

class RootStack extends Stack {
sourceBucket: IBucket;
constructor(scope: Construct) {
super(scope, my - stack - name, { ...options });

// I have multiple cloudfront distributions and need use a unique bucket for them,
// so i need have a pre existent bucket to conceed permission by folder path at my 'shared' s3 bucket
const subdomain = 'my-subdomain-value';

// get existent bucket
this.sourceBucket = Bucket.fromBucketAttributes(this, 'DefaultS3BucketContent', {
bucketArn: 'your-bucket-arn-here',
});

const myOriginAccessIdentity = new OriginAccessIdentity(this, 'CloudFrontPreviewOAI', {
comment: 'Owner Plataforma Web - OAI created by AWS CDK for deploy-preview',
});

// PROBLEM HERE
// always return this.sourceBucket.policy === undefined
console.info('your bucket policy', this.sourceBucket.policy);

const myPolicyStatement = new PolicyStatement({
actions: ['s3:GetObject'],
resources: [this.sourceBucket.arnForObjects(`/${subdomain}/*`)],
principals: [this.myOriginAccessIdentity.grantPrincipal],
});

// policyStatement.addActions('s3:GetObject*');
// policyStatement.addResources(this.sourceBucket.bucketArn);
// policyStatement.addResources(`${this.sourceBucket.bucketArn}/${subdomain}/*`);
// policyStatement.addCanonicalUserPrincipal(this.myOriginAccessIdentity.cloudFrontOriginAccessIdentityS3CanonicalUserId);

// THEN I NEED ADD NEW STATEMENT TO THE MY BUCKET POLICY
// but always .policy returns as undefined
this.sourceBucket.policy.document.addStatements(myPolicyStatement);

...
}
}

new RootStack(new App());

```
3 - deploy stack
run `cdk deploy`

### Possible Solution

Creates the method: BucketPolicy.fromBucketPolicy at https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-s3.BucketPolicy.html module.

### Additional Information/Context

_No response_

### CDK CLI Version

2.22.0

### Framework Version

"aws-cdk-lib": "2.22.0",

### Node.js Version

12/14

### OS

macOS

### Language

Typescript

### Language Version

4.3.5

### Other information

_No response_

Start by reading the aws-s3 APIs used in the report, especially Bucket.fromBucketAttributes and BucketPolicy.fromBucketPolicy, then compare the requested behavior with the AWS SDK GetBucketPolicyCommand. Check how cdk deploy would obtain and represent an existing policy. Done means the proposed lookup behavior is defined and supports the reported policy-use case without leaving policy undefined.

Written by the indexing model from the issue text.