Allow stringMatch on serviceInstance and resource, and say which attributes accept it

Problem:
Creating a policy with operator stringMatch on serviceInstance or resource is refused ("Operator stringMatch can't be used on attribute ..."), while it is accepted on a Cloud Object Storage path. A new policy without serviceName or serviceType is also refused ("The policy resource must have one of the following attribute(s): serviceName, serviceType"), even though older policies of that shape exist and still apply.

Use case:
We manage several client environments with naming conventions (for example every instance or resource named prod-*). Without wildcards on serviceInstance/resource we must create and maintain one policy per instance, and every new instance needs a policy change. When reviewing accounts, older account-wide policies exist that can no longer be created, so the same access cannot be reproduced or documented the same way.

Request:
- stringMatch (and stringMatchAnyOf) on serviceInstance and resource, or
- at least, the list of attributes and operators each service accepts, in the documentation and in an API, so tooling can validate a policy before sending it.