Buckets restricted to CloudFront are incorrect identified as being public

You can restrict access to an S3 bucket to CloudFront as shown here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

with the example policy:
```
{
"Version": "2012-10-17",
"Id": "PolicyForCloudFrontPrivateContent",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EH1HDMB1FH2TC"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::awsexamplebucket/*"
}
]
}
```

A bucket that is restricted like that will show as a being a high severity finding for being internet accessible due to PolicyUniverse not taking this case into consideration: https://github.com/Netflix-Skunkworks/policyuniverse/blob/49804b10dc6e197f5149b3cbb2b739e30030df73/policyuniverse/statement.py#L325

This access should probably be info level as it is "public" through the CloudFront (assuming the CloudFront is publicly accessible).