Handle `AccessDeniedException` while creating permission set for management account, and update documentation about access to management account

[EreminAnton]

If Elevator is deployed into the SSO delegated administrator account, it will fail to create an account assignment for the management account with any permission set. Additionally, Elevator will fail to create account assignments to any account if the permission set used is also assigned to the management account (so we need to have separate permission sets for management and non-management accounts). We need to handle the AccessDeniedException for account assignment creation if the target is the management account, so we will send a more reasonable error to Slack.