(AWS::EC2::SecurityGroup) Option to toggle ServiceCatalog's AutoTags from being included in drift detection

### Name of the resource

AWS::EC2::SecurityGroup

### Resource name

_No response_

### Description

Service Catalog automatically adds service-managed tags to provisioned resources, called [AutoTags}(https://docs.aws.amazon.com/servicecatalog/latest/adminguide/autotags.html). These tags are distinguishable by their ```aws:-*``` prefix. and cannot be deleted.

There has been an [edge case](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1199) whereby Cloudformation now detects these AutoTags as drift on the resource (in this case [AWS::EC2::SecurityGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html). In this particular use-case, adding the AutoTags to the templates to bring the stack in-sync with the provisioned resources is not an option, and as the AutoTags are service-managed and therefore cannot be deleted, there seems to be no way to resolve the drift on the stacks.

It would be nice if Cloudformation would detect tags with the reserved ```aws-*``` prefix as ServiceCatalog AutoTags and ignore them during drift detection. Might as well make this toggle-able while we're at it.

Please let me know if i can elaborate or clarify

### Other Details

_No response_

Start with the AWS::EC2::SecurityGroup documentation and the linked Service Catalog AutoTags and coverage-roadmap issues to confirm the reserved-tag behavior. Define how a toggle for drift detection should treat service-managed tags, then verify that the requested behavior resolves the reported drift without hiding other changes.

Written by the indexing model from the issue text.