(aws-cdk/aws-s3): bucket.grantRead does nothing when bucket is imported and grantee identity policy is absent

### Describe the bug

I created an S3 bucket in Stack1. In Stack 2, referencing this bucket using `bucket.fromAttributes` methods. In Stack2 I also created a CloudFrontDistribution and OriginAccessIdentity. Then grant access to OriginAccessIdentity. After deploying these stacks, no updates made to Bucket policy. Also no errors thrown during deployment.

### Expected Behavior

OriginAccessIdentity should be granted Read access on S3 Bucket.

### Current Behavior

It doesn't grant read access.

### Reproduction Steps

Code for Stack1
```
export default class StaticAssetsStack extends Stack {

public readonly staticAssetsBucket : IBucket;

constructor(parent: App, name: string, props: StaticAssetsStackProps) {
super(parent, name, props);

this.staticAssetsBucket = new Bucket(this, `AssetBucket`, {
versioned: false,
bucketName: `website-assets`.toLowerCase(),
removalPolicy: RemovalPolicy.RETAIN,
enforceSSL: true,
encryption: BucketEncryption.S3_MANAGED,
});
}
}
```

Code for Stack2
```
export default class WebsiteStack extends Stack {
constructor(parent: App, name: string, props: WebsiteStackProps) {
super(parent, name, props);

const staticAssetsBucket = Bucket.fromBucketAttributes(this, `staticAssetsBucket`, {
bucketName: props.staticAssetsBucketName,
region: props.staticAssetsBucketRegion
});
const originAccessIdentity =
new OriginAccessIdentity(this, `${props.name}-OAI`);
staticAssetsBucket.grantRead(originAccessIdentity);
const s3Origin = new S3Origin(staticAssetsBucket, {
originAccessIdentity,
});
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

CDKv2

### Framework Version

_No response_

### Node.js Version

14.x

### OS

Linux

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Start at the CDK S3 entry points named in the report—Bucket.fromBucketAttributes and grantRead—and trace how an imported bucket handles an OriginAccessIdentity when no identity policy exists. Reproduce the two-stack case and add regression coverage verifying that the expected S3 bucket policy update occurs.

Written by the indexing model from the issue text.