(aws-stepfunctions): Restrict permissions from `grantRead`

### Describe the bug

The `StateMachine.grantRead` [function](https://github.com/aws/aws-cdk/blob/v2.79.0/packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine.ts#L205-L232) appears to grant IAM permissions that are overly broad (and in some cases incorrect according to AWS documentation

### Expected Behavior

Based on the [AWS IAM Step Functions docs](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsstepfunctions.html):

- `states:ListStateMachines` must specify all Resources (`*`)
- `states:DescribeStateMachine` may specify a `statemachine` Resource ARN

I also do not expect `grantRead` on a `StateMachine` to grant `states:ListActivities` and `states:DescribeActivity` at all.

### Current Behavior

- `states:ListStateMachines` is granted to the statemachine ARN
- `states:DescribeStateMachine` is granted to all resources (`*`)

- `states:ListActivities` is granted to all resources (`*`)
- `states:DescribeActivity` is granted to all resources (`*`)

### Reproduction Steps

Perfom `grantRead` against a statemachine.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.79.0

### Framework Version

_No response_

### Node.js Version

18

### OS

MacOS

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Start in packages/aws-cdk-lib/aws-stepfunctions/lib/state-machine.ts, at StateMachine.grantRead. Compare the generated permissions with the AWS IAM Step Functions documentation linked in the issue: ListStateMachines should use all resources, DescribeStateMachine should use the state machine ARN, and activity permissions should be absent. Done means grantRead produces only those expected permissions.

Written by the indexing model from the issue text.