Add stricter checking to resource attributes

[briandbecker]

• Certain resource strings were incorrectly accepted as valid
• Adds is_arn_strictly_valid function to do tighter checks on resources
  against their documented requirements
• Appears to fix parliament should catch invalid s3 bucket object resource arns #167

Example

The following policy validates in the current version but fails when applied in AWS:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoleTags"
            ],
            "Resource": "arn:aws:iam::123456789012:*/*"
        }
    ]
}

With this change it now catches this violation. All other tests pass.

I didn't include these in the is_arn_match function as these checks aren't strictly about matching arns.

[CLAassistant]

All committers have signed the CLA.

[0xdabbad00]

Thank you @briandbecker! The logic in this is pretty complex, but if the tests pass, it must work. Nice job figuring this out!

This is ready to merge @steiza