Use same access controls for Pull Request previews and for their base branch

### Before opening, please confirm:

- [X] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting questions](https://github.com/aws-amplify/amplify-hosting/blob/master/CONTRIBUTING.md).
- [X] I have removed any sensitive information from my code snippets and submission.

### App Id

d29c1yqogx24ke

### AWS Region

eu-west-1

### Amplify Hosting feature

Access control, Web previews

### Is your feature request related to a problem? Please describe:

Previews created for Pull Requests are by default Publicly viewable, even if the base branch of the pull request is password-restricted. This is confusing and risky.

### Describe how you'd like this feature to work

In my Git repository, I have:
- a **`prod`** branch (mapped to a publicly available production website)
- a **`dev`** branch (mapped to a password-protected staging website)

Pull requests are opened against `dev` branch. However, previews are created publicly available.

I can protect each preview environment after its creation, but it requires a manual step.
I can also apply a global password, but it will restrict my public production website.

This is an alternate request to #280, which requests adding the option to restrict access to all new branches.

Start with the access-control and Web previews behavior described here, then read the related issue #280 and the linked FAQ and contributing guide. Done means Pull Request previews inherit the base branch's password restriction without restricting the public production branch.

Written by the indexing model from the issue text.