aws-s3: option for Bucket.grantDelete to not grant s3:DeleteObjectVersion

### Describe the feature

Allow an easy way of granting an identity permission to modify the contents of a versioned bucket, but not delete versions.

### Use Case

I want to be able to grant applications permissions to modify objects in a bucket as they need to, but want be sure that they won't permanently delete data. Enabling versioning on the bucket allows this, but if the applications are granted `s3:DeleteObjectVersion` then a bug or compromise of that application could still delete all data from the bucket including previous versions.

I think this one of the natural uses of S3 versioning, and so the CDK making it easy to grant a suitable set of permissions for this would be helpful.

### Proposed Solution

Perhaps add an option like `exceptVersions: boolean` to `Bucket.grantDelete`. Or maybe add a new method.

### Other Information

There might already be an easy way to do this with the other `Bucket.grant*` methods, eg with `Bucket.grantWrite` and passing some values from https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-s3/lib/perms.ts as the third argument.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.171.1

### Environment details (OS name and version, etc.)

n/a

Start with the Bucket.grantDelete and Bucket.grantWrite entry points and inspect the permission definitions in packages/aws-cdk-lib/aws-s3/lib/perms.ts. Determine whether an option or a separate method best grants object modification permissions without s3:DeleteObjectVersion. Done means the API clearly supports versioned buckets while excluding that permission.

Written by the indexing model from the issue text.