Support principal org ID as a psuedo parameter

### Resource Name

_No response_

### Details

In my organisation we commonly produce stacks containing resources that are designed to be accessed by any account in our AWS organisation. Currently we achieve this by hardcoding our principal organisation ID in IAM resource policy conditions, for example.

It would be easier for us if we could achieve this with the use of psuedo parameters, e.g.
```yaml
Statement:
- Effect: Allow
Principal:
AWS: "*"
Action:
- sqs:SendMessage
Resource:
- !GetAtt Queue.Arn
Condition:
StringEquals:
aws:PrincipalOrgID: !Sub "{AWS::PrincipalOrgId}"
```