cli: permissions snapshot integration testing

### Describe the feature

Every CLI integration test will record a file containing all IAM roles it assumed and all IAM actions it performed during the test execution.

This file will serve as a snapshot, which will fail the test in case it contains changes.

### Use Case

It is not uncommon for organizations to have very strict IAM policy requirements. So strict in fact that the roles used by the CLI are configured to only allow the actions and principals that are **currently** required for it to operate.

In such cases, any changes to which roles are assumed, or which actions are performed will break customer deployments. While the CDK doesn't make guarantees it will never do so (it would be close to impossible to add new features if we did), it would still be advantageous to catch those occurrences and handle them with more care.

> Examples: https://github.com/aws/aws-cdk/issues/29483, https://github.com/aws/aws-cdk/issues/32219

### Proposed Solution

One option to catch these types of changes is configure our own policies to be as strict as possible when we run integration tests. This however can be cumbersome to operate and maintain. Instead, we would like an automatic mechanism that doesn't require infrastructure changes.

Research required, but there must be a way to hook into the aws sdk and intercept service calls, to form a snapshot of the roles and actions used during the test.

In case a test fails because the snapshot changed, we will:

1. Determine if the change is expected. If it isn't - great, we caught a bug.
2. If it is, we bypass the validation and proceed. In this case, the snapshot file can serve as data that we can communicate to our customers, notifying them about what exactly changed so they can prepare for it.

The aggregation of all snapshots from all tests can also serve as a public document, detailing which actions are required for each command.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

ALL

### Environment details (OS name and version, etc.)

ALL

Start by examining the CLI integration test harness and researching how the AWS SDK can be intercepted to record assumed IAM roles and performed actions. The work is done when each integration test produces a snapshot, detects unexpected changes, and supports explicitly bypassing validation for expected changes.

Written by the indexing model from the issue text.