iam-policy-diff — a semantic diff of two AWS IAM policies

Show a semantic diff of two AWS IAM policies: what access actually changed — expanded wildcards, effective permission sets, and privilege-escalation risks — not what text changed.