(DynamoDB): Narrow global table policy permissions to use specific actions instead of a wildcard

### Describe the bug

When using Amazon DynamoDB Global Tables with AWS CDK as described in https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb-readme.html#amazon-dynamodb-global-tables the generated IAM policy fails the `[IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services` AWS Foundational Security Best Practices controls check.

SecurityHub _does_ offer [remediation instructions](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#iam-21-remediation) but I believe that CDK should not create non-SecurityHub compliant policies by default.

### Expected Behavior

When using `replicationRegions` prop in `Table` construct the generated IAM policy should be fully SecurityHub compliant.

### Current Behavior

The generated rule fails the following check:

>[IAM.21] This control checks whether the IAM identity-based custom policies have Allow statements that grant permissions for all actions on a service. The control fails if any policy statement includes "Effect": "Allow" with "Action": "Service:*".

Example generated IAM rule looks like this:

```
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "dynamodb:*",
"Resource": [
"arn:aws:dynamodb:us-east-1:ACCOUNT_NUMBER:table/TABLE_NAME"
],
"Effect": "Allow"
},
{
"Action": "dynamodb:*",
"Resource": "arn:aws:dynamodb:us-west-2:ACCOUNT_NUMBER:table/TABLE_NAME",
"Effect": "Allow"
}
]
}
```

### Reproduction Steps

Provision a DynamoDB table, for instance using the following snippet:

```ts
const myTable = new Table(this, 'my-table', {
billingMode: BillingMode.PAY_PER_REQUEST,
partitionKey: {
name: "pk",
type: AttributeType.STRING,
},
removalPolicy: cdk.RemovalPolicy.RETAIN,
sortKey: {
name: "sk",
type: AttributeType.STRING,
},
pointInTimeRecovery: true,
replicationRegions: ['us-west-2'],
});
```

Go to SecurityHub and notice that `myTable` will trigger a `IAM customer managed policies that you create should not allow wildcard actions for services` low severity check from AWS Foundational Security Best Practices v1.0.0 standard.

### Possible Solution

Scope down the generated policy in order to avoid granting permission for all actions on provisioned DDB table.

According to [Using IAM with global tables](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/V2gt_IAM.html) documentation, only the following permissions are required:

Then again, a comment in the CDK codebase seems to suggest that this documentation is incorrect (?)

https://github.com/aws/aws-cdk/blob/main/packages/@aws-cdk/aws-dynamodb/lib/table.ts#L1621

### Additional Information/Context

_No response_

### CDK CLI Version

2.55.1

### Framework Version

_No response_

### Node.js Version

16.16.0

### OS

MacOS 13.1 (22C65)

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Start in packages/@aws-cdk/aws-dynamodb/lib/table.ts around the linked line 1621, then compare the generated global-table policy with the AWS IAM global tables documentation. Reproduce the Table construct using replicationRegions and verify that the resulting policy uses only the required specific actions rather than dynamodb:* and passes the IAM.21 expectation.

Written by the indexing model from the issue text.