Check for overlapping resource permissions

- It doesn't make sense to have both a policy and an ACL on an S3 bucket allowing public read access (info level).
- It also doesn't make sense to have an ACL that restricts access to a specific CloudFront origin for read, while the ACL additionally, or policy, allows public access (warn).
- If a policy attempts to restrict access in some way for a specific principal of some sort, but then allows the same or larger permissions for public access, this should warn.
- AuthenticatedUsers in an S3 policy should always warn, as there is never a good reason to use that.