feat(spec2cdk): generate a grant() method in L1 constructs

[otaviomacedo]

Add a generic grant() method to L1 constructs, of the form:

/**
 * Grant the given IGrantable permissions to perform the actions specified in actions on this resource.
 *
 * @param grantee The principal to grant permissions to.
 * @param actions The actions to grant permissions for.
 * @param conditions The conditions under which the actions should be allowed.
 */
public grant(grantee: iam.IGrantable, actions: Array<string>, conditions?: Record<string, Record<string, unknown>>): iam.Grant {
  return iam.Grant.addToPrincipal({
    "grantee": grantee,
    "actions": actions,
    "resourceArns": [this.attrArn],
    "scope": this,
    "conditions": conditions
  });
}

The only variation between different constructs is the ARN attribute name, passed in an array to resourceArns.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Features must contain a change to a README file.
❌ Features must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

[rix0rrr]

I guess we didn't really talk about this yet or write it down anywhere, but I want something like the following:

class BucketGrants {
  public static fromBucketRef(bucketRef: IBucketRef) { /* ... */ }

  constructor(private readonly bucketName: string /* all dimensions here */, resourceWithPolicy?: IResourceWithPolicy) { }

  public readData(grantee) {
  }
}

Or something similar, didn't nail down the specifics yet. We need to do some thinking around keys and resource policies as well, and what data we need in the database.

The main selling point would be that the grants facility isn't tied to any particular construct.