[AWS::SNS::Subscription] - [Enhancement] - Add AuthenticateOnUnsubscribe property

### Name of the resource

AWS::SNS::Subscription

### Resource name

_No response_

### Description

The AWS CLI [`confirm-subscription`](https://docs.aws.amazon.com/cli/latest/reference/sns/confirm-subscription.html) command supports the `--authenticate-on-unsubscribe true` parameter. When set, any subsequent unsubscribe request requires a valid AWS signature. Hence, a simple unauthenticated GET request to the unsubscribe URL will be rejected.

CloudFormation currently has no way to set this flag. When a subscription is confirmed (either by the recipient clicking the confirmation link, or by an automated link scanner following it), `AuthenticateOnUnsubscribe` is always `false`.

**The problem:**

Most modern email systems (Microsoft Defender Safe Links, Google Safe Browsing, Proofpoint, Mimecast, etc.) include automated URL scanners that follow every link in incoming emails for security inspection. SNS notification emails contain an unsubscribe URL as a simple GET endpoint with no authentication required.

When an SNS email notification arrives at such a system:
1. The email security scanner follows all URLs in the message - including the unsubscribe link
2. SNS processes the unauthenticated GET request as a valid unsubscribe
3. The subscription is immediately removed
4. No further notifications are delivered

This makes SNS email subscriptions fundamentally unusable with any email system that has link scanning enabled, which includes virtually all enterprise email (Microsoft 365, Google Workspace) and collaboration tools like Microsoft Teams channel email addresses (e.g. `*@emea.teams.ms`).

**Proposed solution:**

Add an `AuthenticateOnUnsubscribe` property (Boolean) to [`AWS::SNS::Subscription`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-subscription.html). When set to `true`, CloudFormation should pass this flag during the internal [`ConfirmSubscription`](https://docs.aws.amazon.com/sns/latest/api/API_ConfirmSubscription.html) API call:

```yaml
Type: AWS::SNS::Subscription
Properties:
TopicArn: !Ref MyTopic
Protocol: email
Endpoint: team-channel@emea.teams.ms
AuthenticateOnUnsubscribe: true
```

### Other Details

- [AWS CLI `confirm-subscription` reference](https://docs.aws.amazon.com/cli/latest/reference/sns/confirm-subscription.html)
- [SNS API `ConfirmSubscription`](https://docs.aws.amazon.com/sns/latest/api/API_ConfirmSubscription.html)
- [CloudFormation `AWS::SNS::Subscription`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-subscription.html)
- Affects any email endpoint behind a link scanner. Such scans are often the default for all major enterprise email providers

Start with the AWS::SNS::Subscription resource documentation and the linked ConfirmSubscription API and AWS CLI references. Determine how the requested Boolean property should be exposed and propagated; done means CloudFormation supports AuthenticateOnUnsubscribe for this resource and confirmation behavior honors it.

Written by the indexing model from the issue text.