fix(assert): Adjust assertion behavior to be stricter

[RomainMuller]

The SUPERSET matching mode would have aborted successfully upon finding
the first acceptable change (a change that is a CREATE), and not look at
subsequent changes, hence allowing any other type of update to pass as
long as it is detected later in the template. This change fixes that such that the
assertion will reject upon any change that is NOT a CREATE change.

Additionally, the default behavior of the haveResource matcher was changed
to not allow additional values in objects below the root of the expectation, which
makes it harder to write tests that inadvertently allow excessive IAM policies or
network security settings (amounts other things) to pass when the user intention
was for them to fail.

BREAKING CHANGE: the behavior change of haveResource can cause tests to
fail. If allowing extension of the expected values is the intended behavior, you can
switch to the haveResourceLike matcher instead, which exposes the previous
behavior.

Fixes awslabs/cdk-ops#186

---

Pull Request Checklist

Please check all boxes, including N/A items:

Testing

• Unit test and/or integration test added
• Toolkit change?: integration tests manually executed (paste output to the PR description)
• Init template change?: coordinated update of integration tests (currently maintained in a private repo).

Documentation

• README: README and/or documentation topic updated
• jsdocs: All public APIs documented

Title and description

• Change type: Title is prefixed with change type:
  • fix(module): <title> bug fix (patch)
  • feat(module): <title> feature/capability (minor)
  • chore(module): <title> won't appear in changelog
  • build(module): <title> won't appear in changelog
• Title format: Title uses lower case and doesn't end with a period
• Breaking change?: Last paragraph of description is: BREAKING CHANGE: <describe exactly what changed and how to achieve similar behavior + link to documentation/gist/issue if more details are required>
• References: Indicate issues fixed via: Fixes #xxx or Closes #xxx

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.