IAM Policy Diff

Compare two IAM policies and report what the change grants or removes. The comparison is over action-and-resource pairs rather than over statements, so a refactor that splits one statement into three reports no change. A newly written pair already covered by a broader unconditioned pattern is noted rather than reported, since nothing new is granted. A removed Deny is reported as a widening even when no Allow changed, because a Deny overrides every Allow.