Allow editing tag values without needing to replace tag

### Name of the resource

AWS::SecretsManager::Secret

### Resource name

_No response_

### Description

If controlling access to secrets using tags like shown [here](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_examples.html#tag-secrets-abac), if you want to change the tag value of the tag being used for access control this is currently only possible through the secrets manager console, CLI, or SDK. Trying to do so through CloudFormation will result in an AccessDenied error unless additional permissions are granted in addition to the tag-based access.

The reason for this is a difference in how the tag value update is handled through CloudFormation vs the other methods. When updating only the tag value through a method other than with CFN, only a call to `TagResource` is made to replace the tag value.

However, when doing so through CloudFormation, and still only modifying the tag's value, it instead first makes a call to `UntagResource` to remove the tag, and then makes a call to `TagResource` to add the tag back with the new value.

Consider the following permissions policy:
```
{
"Effect": "Allow",
"Action": [
"secretsmanager:*"
],
"Resource": "arn:aws:secretsmanager:*::secret:*",
"Condition": {
"StringEquals": {
"secretsmanager:ResourceTag/TestSecretTag": [
"test-tag-1",
"test-tag-2"
]
}
}
},
```

If the secret was initially created with the resource tag { "TestSecretTag": "test-tag-1" }, and the value for this tag needed to be changed to "test-tag-2", this could not be performed through CFN but could through the console.

It would be nice for CFN to be able to detect if the secret resource tag's key is being changed or not, and then take the appropriate action(s) to update this. If only the tag's value is being changed, then only a call to `TagResource` would be needed. Otherwise it could continue with the current functionality of calling `UntagResource` then `TagResource` to replace the tag.

### Other Details

_No response_

Start with the AWS::SecretsManager::Secret tag update behavior described in the issue, comparing the TagResource and UntagResource calls made for value-only changes. Done means changing an existing tag value through CloudFormation works with the tag-based permissions described, without requiring an additional UntagResource permission.

Written by the indexing model from the issue text.