s3 bucket notifications creates IAM policy that has no resource boundary

Forked off from https://github.com/aws/aws-cdk/issues/2781, specifically [this comment](https://github.com/aws/aws-cdk/issues/2781#issuecomment-543759478)

S3 bucket notifications creates an IAM role holding a policy that contains no resource boundary, specifically `"Resource": "*"`.

Companies typically enforce that all IAM policies should be well bounded in their actions and resource.

https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-s3-notifications/test/integ.notifications.expected.json#L188-L208

Start with packages/@aws-cdk/aws-s3-notifications/test/integ.notifications.expected.json around lines 188-208 and review the linked parent issue and comment for context. Trace how the S3 bucket notification IAM role and its policy are generated, then define an appropriately bounded resource and update the integration expectation so the generated policy no longer uses Resource "*".

Written by the indexing model from the issue text.