Add more IAM actions

[dnmfarrell]

We only ship src/iam/s3.pl. We should add the actions for other AWS services
(DynamoDB, etc.), each in its own file (e.g. src/iam/dynamodb.pl) so they can
be loaded on demand.

The per-service extension mechanism is already in place: a service file defines
its own action/1 facts and can hook arn_verify/2 (declared :- multifile)
to add service-specific ARN rules, as s3.pl does.

What's still missing for true on-demand loading: s3 is currently imported
statically in src/iam/sim.pl (:- use_module('s3').). To make services load
on demand, we'd need a way to pull in a service file only when it's first
referenced rather than importing each one up front.

Sub-tasks:

• add action files for additional services (one file per service).
• make service modules load on demand instead of being hardcoded in sim.pl.

[dnmfarrell]

These can be generated from
https://awspolicygen.s3.amazonaws.com/js/policies.js

[dnmfarrell]

Or even
https://www.awsiamactions.io/json

[dnmfarrell]

Pausing this for now, I think it would be better to go deep and add the other features ticketed in #2 before expanding the services used.