Document required permissions to call SageMaker MLflow service

We did a small PoC for cross-account invocation: run code with AWS credentials available for a role in account A, and use SageMaker MLflow app in account B. There is a role `mlflow-cross-account` in account B, which the role in account A can assume without any issues.

We had assigned the following permissions to `mlflow-cross-account`; on `"Resources": "*"`
- `sagemaker-mlflow:*`
- `sagemaker:ListMlflowTrackingServers`
- `sagemaker:StartMlflowTrackingServer`
- `sagemaker:StopMlflowTrackingServer`

This resulted in 403 errors from the MLflow tracking server API. After much grinding of teeth, we figured out that the following permission was missing:
- `sagemaker:CallMlflowAppApi`

This is of course mostly an AWS documentation issue (that action is very sparsely documented), but it would likely help users of this plugin to get a hint from here that `sagemaker-mlflow:*` alone does not suffice.

I can create a PR for this (another section in the README + link to AWS product documentation), unless the maintainers raise objections.

Start with the README and the AWS product documentation for SageMaker MLflow permissions. Add a section explaining that sagemaker-mlflow:* alone does not grant API access and that sagemaker:CallMlflowAppApi is also required. Done means the README includes this guidance and a link to the relevant AWS documentation.

Written by the indexing model from the issue text.