RFC 617: CloudFront S3 Origin Access Control L2 (#624)

This is a request for comments about CloudFront Origin Access Control L2
for S3 origins. See #617 for
additional details. 

APIs are signed off by @comcalvi  .

---

_By submitting this pull request, I confirm that my contribution is made
under
the terms of the Apache-2.0 license_

---------

Co-authored-by: gracelu0 <grace.r.luo@gmail.com>