aws-iam-least-priv — right-size IAM roles from what they actually did

Right-size over-broad IAM roles using CloudTrail: aggregate what a role actually did, synthesize a least-privilege policy, and diff it against the attached one.