aws-s3: `Bucket.grantRead()` doesn't work

### Describe the bug

The `Bucket.grantRead()` method doesn't add any policy to the S3 bucket.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

see above.

### Current Behavior

see above.

### Reproduction Steps

```ts
const configBucket = new Bucket(this, "ConfigBucket", {
removalPolicy: RemovalPolicy.DESTROY,
autoDeleteObjects: true,
});

const instanceRole = new Role(this, "AppRunnerInstanceRole", {
assumedBy: new ServicePrincipal("tasks.apprunner.amazonaws.com"),
});

configBucket.grantRead(instanceRole);
```

The resulting bucket policy of `configBucket`:

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::XXXXXXXXXXXX:role/cdk-aws-apprunner-dev-CustomS3AutoDeleteObjectsCust-pjNpAHyW1OjH"
},
"Action": [
"s3:PutBucketPolicy",
"s3:GetBucket*",
"s3:List*",
"s3:DeleteObject*"
],
"Resource": [
"arn:aws:s3:::cdk-aws-apprunner-dev-otelconfigbucketd98a94f8-wjndkbeqsonm",
"arn:aws:s3:::cdk-aws-apprunner-dev-otelconfigbucketd98a94f8-wjndkbeqsonm/*"
]
}
]
}
```

### Possible Solution

Use this instead:

```ts
configBucket.addToResourcePolicy(
new PolicyStatement({
actions: ["s3:GetObject"],
resources: [configBucket.arnForObjects("*")],
principals: [instanceRole],
}),
);
```

### Additional Information/Context

_No response_

### CDK CLI Version

2.174.1

### Framework Version

_No response_

### Node.js Version

22.12.0

### OS

Ubuntu 24.04.1

### Language

TypeScript

### Language Version

_No response_

### Other information

Similar issue: #31358

Start at the Bucket.grantRead() entry point and compare its behavior with the provided addToResourcePolicy example. Synthesize the reproduction and inspect the S3 bucket policy; done means grantRead produces s3:GetObject access for instanceRole.

Written by the indexing model from the issue text.