Fix #7103 Add source account to lambda permissions for s3 events

[callumsmits]

What did you implement

This PR adds the SourceAccount condition with the current account to the lambda permission for s3 events.

Closes #7103

How can we verify it

Deploy a function with an s3 event trigger:

photoupload:
    handler: photoupload.handler
    description: Process images dropped into S3
    events:
    - s3:
        bucket: mybucket
        event: s3:ObjectCreated:*

The lambda policy will now include the AWS:SourceAccount condition:

{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "autogensid",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:us-east-1:999999999999:function:photoupload",
      "Condition": {
        "StringEquals": {
          "AWS:SourceAccount": "999999999999"
        },
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:s3:::mybucket"
        }
      }
    }
  ]
}

Todos

• Write and run all tests
• Write documentation
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: YES
Is it a breaking change?: Only if users unintentionally rely on this behavior (which is unlikely and they really shouldn't).

[medikoo]

Thank you @callumsmits looks great!