Policy variables in condition values: Version 2008-10-17 and the escapes #534

Two policy variable rules in condition values differ from IAM. Both are in expand_policy_variables in crates/auth/src/policy/condition.rs on main.

1. A condition value in a 2008-10-17 document, or one with no Version, is expanded. IAM treats a variable there as literal text. evaluate_statement_conditions has no access to the document's Version, so the expansion runs for every document.
2. ${*}, ${?} and ${$} in a condition value are left as the four-character text. IAM expands them to *, ? and $.

Measured with aws iam simulate-custom-policy on 2026-10-24, action dynamodb:GetItem, Allow dynamodb:* on * beside the statement under test, resource arn:aws:dynamodb:us-east-1:123456789012:table/blue:

Fix: pass whether the document expands policy variables into the condition evaluation, and expand the escapes in condition values. For the escapes, a StringLike or ArnLike value that holds ${*} needs the escaped character to stay literal where a written * is a wildcard, so the comparison has to take the expanded value with its wildcard positions marked rather than a plain string.