Get an Access Analyzer finding

Retrieves the full detail read model for a single Access Analyzer finding, powering the finding detail page: the exposed resource and its ARN, an optional console deep-link (resourceHref), the external principal, exposure class, granted access level and concrete actions, the rendered granting policy statement (sid/effect/service/actions/resources/conditions), the analyzer recommendation, and the analyzed/first-observed timestamps. Validation: scopeId must be an accessible scope and accessFindingId must reference a finding inside that scope; an unknown or out-of-scope id maps to NOT_FOUND (404). No body or mutation parameters exist. Async & state: Synchronous read; no state change. Errors: 401 when unauthenticated; 403 from either of two checks — the caller's role does not grant IAM read on the scope, or a bearer API token is missing the iam:read action scope (token principals only, so even an owner's token gets 403 without it); 404 when the finding does not exist or is not visible in this scope; 500 on read-model failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required. The response carries no ETag; archive and resolve do not check If-Match.