Preserve resources when guessing actions

#22 introduced a feature to guess actions that are similar to an existing policy. It currently always guesses `*` resources.
Extend this feature so that resources are preserved as appropriate:

Input
```json
{
"Action": ["s3:PutObject"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::some-bucket"]
}
```

Expected guess:
```json
{
"Action": [ "s3:DeleteObject","s3:GetObject","s3:ListObjects"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::some-bucket"]
}
```

Pitfall: Some actions only support `"*"`!

Start by tracing the action-guessing feature introduced in issue #22 and locate where guessed resources are assigned. Use the provided S3 policy as the expected behavior, then check actions that support only "*" resources. Done means resource ARNs are preserved where appropriate without breaking wildcard-only actions.

Written by the indexing model from the issue text.