Add ability to annotate that a function needs access to S3 bucket

We have a function that subscribes to an SNS topic, that broadcasts changes to an S3 bucket. When the function is triggered, it gets the S3 object details and attempts to access the object. However, Chalice does not automatically configure the correct S3 permissions, since we have not indicated that the function needs S3 access.

It would be helpful to somehow 'tell' Chalice that 'inside this function, we need to access S3', so it could automatically configure the correct permissions. This could be done, for example, by a decorator.

Start by tracing how Chalice configures IAM permissions for an SNS-triggered function, then examine how access to the S3 object could be declared. Done means a supported annotation or declaration causes the required S3 permissions to be generated for the described SNS-to-S3 flow.

Written by the indexing model from the issue text.