Add new read actions to detection list

[spookerlabs]

We did some research here https://sidechannel.blog/en/unwanted-permissions-that-may-impact-security-when-using-the-readonlyaccess-policy-in-aws/

READ_ONLY_DATA_EXFILTRATION_ACTIONS = [ "apigateway:GET", "athena:GetDatabase", "athena:GetQueryExecution", "athena:GetQueryResults", "cassandra:Select", "chime:Retrieve*", "cloudtrail:LookupEvents", "config:SelectResourceConfig", "datapipeline:QueryObjects", "dax:Query", "dax:Scan", "dynamodb:Get*", "dynamodb:Query", "dynamodb:Scan", "ec2:DescribeInstanceAttribute", "ec2:GetConsoleOutput", "ec2:GetConsoleScreenshot", "es:ESHttpGet", "glue:GetDatabase", "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "kendra:Query", "lambda:GetFunction", "logs:StartQuery", "s3:GetObject", "s3-object-lambda:GetObject", "ssm:GetDocument", "ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath" ]

Add to ACTIONS_THAT_RETURN_CREDENTIALS codeartifact:GetAuthorizationToken