support ldap:username for policy substitution (#12390)

LDAPusername is the simpler form of LDAPUser (userDN),
using a simpler version is convenient from policy
conditions point of view, since these are unique id's
used for LDAP login.

docs/sts/rw-ldap-username.json

@@ -4,10 +4,10 @@
     {
       "Effect": "Allow",
       "Action": [
-        "s3:ListBucket"
+        "s3:*"
       ],
       "Resource": [
-        "arn:aws:s3:::${ldap:user}"
+        "arn:aws:s3:::${ldap:username}/*"
       ]
     }
   ]