[AWS::ElastiCache::ReplicationGroup] - [BUG] - Switching from AuthToken to ACLs (UserGroupIds) forces Replacement (no in-place update), unlike Console/CLI

### Name of the resource

AWS::ElastiCache::ReplicationGroup

### Resource Name

_No response_

### Issue Description

When migrating an ElastiCache for Redis replication group from password-based auth (AuthToken) to Redis ACLs (UserGroupIds) via CloudFormation, the update plan shows Resource update type: Replacement and attempts to create a new replication group. The same change performed via AWS Console or CLI is an in-place update with no replacement. This blocks zero-downtime migrations when stacks are managed by CloudFormation.

### Expected Behavior

CloudFormation should support in-place updates when removing AuthToken and Adding UserGroupIds matching the behavior available via Console/CLI, enabling zero-downtime migration paths.

### Observed Behavior

Change Set/Update shows Replacement for AWS::ElastiCache::ReplicationGroup when toggling between AuthToken and UserGroupIds.

### Test Cases

Initial template (password-based):

```
Resources:
MyRedis:
Type: AWS::ElastiCache::ReplicationGroup
Properties:
ReplicationGroupId: my-redis
Engine: redis
EngineVersion: 7.1
CacheNodeType: cache.t4g.small
NumNodeGroups: 1
ReplicasPerNodeGroup: 1
AuthToken: "{{resolve:secretsmanager:my/redis/password}}"
TransitEncryptionEnabled: true
AtRestEncryptionEnabled: true
```
Update template (ACL-based):

```
Resources:
MyRedis:
Type: AWS::ElastiCache::ReplicationGroup
Properties:
ReplicationGroupId: my-redis
Engine: redis
EngineVersion: 7.1
CacheNodeType: cache.t4g.small
NumNodeGroups: 1
ReplicasPerNodeGroup: 1
# AuthToken removed
UserGroupIds:
- myapp-acl-group
TransitEncryptionEnabled: true
AtRestEncryptionEnabled: true
```
**Result**: Change Set marks MyRedis as Replacement.

### Other Details

Resource replacement implies downtime and potential data migration/cutover work.
Import is not available for this resource type, so “remove from stack → modify manually → re-import” is not a workaround.

**Request**

- Add CloudFormation support for in-place updates when toggling between AuthToken and UserGroupIds, aligning with Console/CLI capabilities.

- Update the existing documentation

Start with the AWS::ElastiCache::ReplicationGroup resource and the initial and update templates in the issue. Compare the CloudFormation change set with the documented Console or CLI migration behavior. Done means switching from AuthToken to UserGroupIds updates in place without replacement and the existing documentation is updated.

Written by the indexing model from the issue text.