cli: document the necessary permissions needed for a successful deployment with assets

When running `cdk deploy` with as assumed role, one must configure the exact permissions this role should have. We should document exactly which policies should these role have. For example:

- `s3:GetBucketLocation`
- `s3:PutObject*`
- ...

These are probably just the permissions described here:

https://github.com/aws/aws-cdk/blob/ddd29b485d5e07c0661ce135460b34d9f2b712e9/packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml#L289-L313

But we should bubble these up to some documentation source.

---

This is a 📕 documentation issue

Start with the referenced packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml lines 289-313 and the cdk deploy assumed-role scenario. Check the awsdocs/aws-cdk-guide documentation structure, then document the required deployment permissions and verify that the listed policies match the bootstrap template.

Written by the indexing model from the issue text.