Improve scoping of access controls

This release improves scoping of the access controls:

1. The DenyEveryoneElse statement scopes its coverage to the account's IAM users instead of all IAM principals, enabling use provisioned by an AWS service via KMS key grants, e.g. DynamoDB
2. Use Like within the Deny when an Allow statement has done so