[Resource Type] - [BUG] - 409 "Unable to create function with tags" when CloudFormation propagates stack-level tags

### Name of the resource

AWS::CloudFront::Function

### Resource Name

_No response_

### Issue Description

Since somewhere between 2026-04-21 and 2026-04-28, every `CreateStack` operation that creates an
`AWS::CloudFront::Function` AND has any stack-level tags fails consistently
with HTTP 409 from CloudFront's `CreateFunction` API:

> Internal error reported from downstream service during operation
> 'Unable to create function with tags at this time. Please retry without
> tags (including stack-level tags if using CloudFormation), using a
> different function name, or try again later.
> (Service: CloudFront, Status Code: 409)'

The error references stack-level tags explicitly, suggesting CloudFormation's
resource provider for `AWS::CloudFront::Function` started passing stack-level
tags into the underlying CloudFront `CreateFunction` API call — and that propagation
path is broken.

Affected for us: `aws-cdk` PR-deployments to eu-central-1. Date of last successful deployment of an unchanged template in our account: 2026-04-21. First failure: 2026-04-28.

### Expected Behavior

A CloudFormation stack containing `AWS::CloudFront::Function` resources and
having stack-level tags applied at stack-creation time should deploy
successfully. The Function resource should either:

(a) have stack-level tags propagated correctly via CloudFront's
`CreateFunction` API, OR
(b) be skipped silently by stack-level tag propagation (which was the
behavior before this regression).

Direct calls to CloudFront's `CreateFunction` API with the exact same tag
set succeed (see "Test Cases" below), so the issue is specifically in how
CloudFormation propagates stack-level tags to this resource type.

### Observed Behavior

The Function resource fails with HTTP 409 from CloudFront during the
`CreateFunction` call:

> Resource handler returned message: "Internal error reported from
> downstream service during operation 'Unable to create function with tags
> at this time. Please retry without tags (including stack-level tags if
> using CloudFormation), using a different function name, or try again
> later. (Service: CloudFront, Status Code: 409)'"

The stack rolls back to `ROLLBACK_COMPLETE`. Every retry of the same stack
fails identically. The CloudFormation template itself has no `Tags`
property on the Function — the only tags involved are the ones passed at
stack-creation time via `--tags`.

Removing `--tags` from the `create-stack` call makes the same template
deploy successfully in ~30 seconds.

The failure also happens when explicit `Tags: []` is set on the Function
in the template, confirming that the propagation occurs at deploy time on
top of resource-level tags, and that opting out per resource is not
possible via the template.

### Test Cases

Minimal reproduction (no CDK, no third-party library). Save as
`cf-diag-stack.yaml`:

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Resources:
ConfigKeyValueStore:
Type: AWS::CloudFront::KeyValueStore
Properties:
Name: repro-kvs
Comment: repro

CloudFrontFn:
Type: AWS::CloudFront::Function
Properties:
Name: repro-fn
AutoPublish: true
FunctionConfig:
Comment: repro-fn
Runtime: cloudfront-js-2.0
KeyValueStoreAssociations:
- KeyValueStoreARN: !GetAtt ConfigKeyValueStore.Arn
FunctionCode: |
function handler(event) { return event.request; }
```

Failing path:
```
aws cloudformation create-stack \
--region eu-central-1 \
--stack-name cffn-tags-repro \
--template-body file://cf-diag-stack.yaml \
--tags Key=pr,Value=demo Key=stack,Value=test Key=stage,Value=dev
```
Expected status: `CREATE_COMPLETE`. Observed status: `ROLLBACK_COMPLETE`
with the 409 above on the Function resource.

Passing path (identical template, no `--tags`):
```
aws cloudformation create-stack \
--region eu-central-1 \
--stack-name cffn-no-tags-repro \
--template-body file://cf-diag-stack.yaml
```
Status: `CREATE_COMPLETE` in ~30 seconds.

Direct API control (proves the underlying CloudFront API accepts these tags):
```
aws cloudfront create-function --cli-input-json '{
"Name": "repro-api",
"FunctionConfig": {"Comment": "repro", "Runtime": "cloudfront-js-2.0"},
"FunctionCode": "ZnVuY3Rpb24gaGFuZGxlcihlKSB7IHJldHVybiBlLnJlcXVlc3Q7IH0K",
"Tags": {"Items": [
{"Key": "pr", "Value": "demo"},
{"Key": "stack", "Value": "test"},
{"Key": "stage", "Value": "dev"}
]}
}'
```
Result: `CreateFunction` succeeds. So tags themselves are not rejected by
CloudFront — the issue is in how CloudFormation propagates them.

Acceptance criteria for a fix:
- The failing CloudFormation deploy above succeeds with `CREATE_COMPLETE`.
- The resulting Function carries the propagated stack tags (or, at
minimum, no tags — matching pre-2026-04-28 behavior).
- Existing Functions in customer accounts that were created before the
regression and currently have empty tag sets are not modified.

### Other Details

Customer-side workaround we've adopted: remove tags from `StackProps.tags`
on stacks that contain a CloudFront Function, then re-apply them as
resource-level tags via a CDK aspect, explicitly skipping both the Stack
itself (to avoid re-introducing stack-level propagation) and the Function
(the buggy resource). This works but means the CloudFormation stack
object itself carries no tags. We will remove this workaround once the
provider is fixed.

Start with the minimal reproduction in cf-diag-stack.yaml and run the tagged and untagged aws cloudformation create-stack commands in eu-central-1. Compare the AWS::CloudFront::Function CreateFunction path with the direct CloudFront API control; done means the tagged stack reaches CREATE_COMPLETE, preserves acceptable tag behavior, and does not modify existing empty-tag Functions.

Written by the indexing model from the issue text.