Port aws-cdk id-based annotations (addWarningV2 / acknowledgeWarning) into a TerraConstructs Annotations facade

[so0k]

cdktn's Annotations is a pre-V2 copy of aws-cdk core: addWarning/addInfo/addError only — no id-based warnings and no acknowledgment/suppression mechanism. Upstream aws-cdk's own docs call unacknowledgeable warnings an anti-pattern (they block --strict-style workflows and are unsilenceable noise for consumers who have deliberately handled the concern).

Proposal: add a small TerraConstructs Annotations facade (e.g. src/annotations.ts) implementing upstream's V2 shape on top of cdktn's metadata:

• addWarningV2(id, message) — emit WARN only if the id is not acknowledged in scope; append an ack hint to the message
• acknowledgeWarning(id, message?) — register the ack for the scope (inherited by children) and strip already-emitted matching warnings

Reference implementation: aws-cdk-lib/core/lib/annotations.ts (Acknowledgements registry + removeWarningDeep). The shape is jsii-compatible upstream, so it should port cleanly.

Payoff — existing call sites already waiting for this:

• src/aws/storage/ecr-repository.ts:733 and :771 (// TODO: Annotations.of(this).addWarningV2(...))
• src/aws/iam/role.ts:749 and :754 (commented-out addWarningV2 calls)
• PR fix: render Distribution functionAssociations; grant lambda:InvokeFunction for public Function URLs #159's [terraconstructs/aws-edge:unpublishedFunctionAssociation] warning (unpublished CloudFront Function associated with a distribution, acknowledged today via a skipPublishCheck prop on FunctionAssociation) — migrate the warning to addWarningV2 with that id, and consider whether acknowledgeWarning can supersede or complement the per-association flag. Update PR fix: render Distribution functionAssociations; grant lambda:InvokeFunction for public Function URLs #159's warning message/reference when this lands.