Add a least privilege policy template to use the SAM CLI

### Describe your idea/feature/enhancement

Following the best practice, we don't want to use a poweruser for developers, however it is not very clear of the least privilege to provide to the IAM user who are using sam cli (at least to run SAM deploy and SAM pipeline bootstrap).
Those automated command are creating resources spanning across many services and takes a lot of time to do trail-and-error type of permission granting.
It would be better to have a least privilege template available for a reference.

### Proposal

Add least privilege template to the documentation.

Things to consider:
1. No changes to the core but to add a IAM policy template to the documentation