feat(aws-certificatemanager): add DnsValidatedCertificateV2

[garysassano]

Reason for this change

DnsValidatedCertificateV2 creates a public DNS-validated ACM certificate with native CloudFormation resources. For cross-region use, certificateRegion creates the owner stack, re-imports the Route 53 zone, and checks the primary name and SANs against zone authority. Core CDK already supports sharing a certificate from an explicitly managed owner stack.

Description of changes

• Keep the certificate in the containing stack by default, create a regional owner with certificateRegion, or use an explicit certificateStack. Generated owners are named <containing stack>-certificates-<region>.
• Support one validation zone or an exact hostedZonesByDomain mapping, and expose the standard ICertificate interface.
• Use weak native cross-stack ARN references, with a guard against sharing a nested owner's certificate outside its top-level stack tree. Weak references to this certificate override the app's default reference strength.
• Add unit tests, a CloudFront integration test with snapshot, and a module README in the same format as the other constructs.

Description of how you validated changes

• Exact-head CI passed the build and JavaScript/Python package jobs. Locally, npm run build passed 436 tests, including 196 ACM tests.
• ACM coverage is 99.07% statements/lines, 98.43% branches, and 100% functions. The uncovered lines are two defensive paths: an unexpected ACM default child and a changed region on a generated owner.
• The integration test was deployed with a real public hosted zone: ACM issued the certificate in us-east-1, CloudFront deployed from eu-central-1 with the expected viewer certificate, and both assertions passed. All stacks, the certificate, the distribution, and the validation record were removed afterwards.
• The committed snapshot was then regenerated without deploying, using the placeholder zone Z23ABC4XYZL05B / example.com that aws-cdk uses, so it contains no real account or hosted-zone identifiers. It compares UNCHANGED with those values.

Checklist

• My code adheres to the CONTRIBUTING GUIDE
• My pull request adheres to the Pull Request Rule

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license