cdk diff "expand"

[eladb]

Currently cdk diff will show full diff only for changed values. We should improve this to allow:

1. Not showing full diffs even for changed values
2. Showing full content for new values as well

Proposed API:

cdk diff --no-expand # show only a list of changed resources
cdk diff --expand=update
cdk diff --expand=new
cdk diff --expand=old
cdk diff --expand=all

I wonder if we should also allow people to opt out of emitting the IAM policy table in diffs (--no-security-diff). Perhaps --mini should imply --no-security-diff and --no-expand?

[hlascelles]

We would like this. Probably related: #679