Auto-created role for Lambda could scope down logs policy

When specifying an `AWS::Serverless::Function` without a role, SAM creates a role and attaches the `AWSLambdaBasicExecutionRole` managed policy to it. This provides write permissions for CloudWatch Logs, in particular:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "*"
}
]
}
```
However, since this is part of a CloudFormation template, SAM could instead attach a non-managed policy that is specifically scoped to the log group for the function:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": {"Fn::Join": [
"", [
"arn:",
{"Ref": "AWS::Partition"},
":logs",
{"Ref": "AWS::Region"},
":",
{"Ref": "AWS::AccountId"},
":log-group:/aws/lambda/",
{"Ref": "SAMFunctionLogicalId"},
":*"
],
]}
}
]
}
```
This is a least-privilege policy, unlike the managed policy. If this is desirable, I can create a PR.