S3 ARNs can contain region & acc for access points and other resources

[dnmfarrell]

Some S3 resources (access points, Object Lambda access points, multi-region
access points, jobs, storage lens, etc.) have ARNs that include a region and/or
account-id, e.g.:

arn:aws:s3:us-east-1:123456789012:accesspoint/my-ap
arn:aws:s3:us-east-1:123456789012:job/my-job-id

Today the code does not handle these. arn_verify/2 in src/iam/s3.pl hard
rejects any s3 ARN whose region or account-id is non-empty ("Region not
empty" / "AccountID not empty"), and the resource//0 grammar only parses
bucket and bucket/object resources — there is no accesspoint/…, job/…, etc.

Note the general ARN parser in src/iam/arn.pl already parses region +
account-id fine, so this work is confined to src/iam/s3.pl:

• relax arn_verify/2 so region/account are allowed for the resource types
  that require them (and still required-empty for bucket/object).
• extend the resource//0 grammar to cover the additional S3 resource types.

Refs:

• https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-resources-for-iam-policies
• https://docs.aws.amazon.com/AmazonS3/latest/userguide/directory-bucket-naming-rules.html
• https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html