Docs: examples of least privileged IAM policies for key generation and signing

[danmx]

We should add least privileged IAM policies for key generation and signing for current examples.

[matdehaast]

Having gone through the code base this is what I came up with for just the signing part. I actually think just Sign and GetPublicKey are required but the two extra calls aren't sensitive so added them in case.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "kms:Verify",
                "kms:Sign",
                "kms:GetPublicKey",
                "kms:DescribeKey"
            ],
            "Resource": "arn:aws:kms:{REGION}:{ACCOUNT_ID}:key/{KEY_ID}"
        }
    ]
}