AWS::CloudFormation::CustomResource - Metadata - Pass initiator of stack operation to custom resource provider

## Scope of request
New feature to be used with AWS::CloudFormation::CustomResource resource type

## Expected behavior
To be able to pass on the IAM entity (user/role) which triggered the stack operation over to the custom resource, alternatively including credentials.

## Any additional context (optional)
The idea would be to allow a custom resource to be able to identify the IAM entity (user/role) which has triggered the stack operation and, consequently, the invocation of the custom resource. This can be useful in different ways, with two examples being:

- validating that the user/role performing the stack operation has rights to use the custom resource
- allowing the custom resource to use that information to perform customized actions

An idea on how to implement this would be by creating a "metadata" section in the custom resource where you'd be able to specify certain properties that are included in the event object sent to the custom resource provider. Example:

```yaml
Resources:
MyCustomResource:
Metadata:
AWS::CloudFormation::CustomResourceRequestData:
include:
- AWS::Initiator
- InitiatorCredentials
- [...]
Type: Custom::MyCustomResource
Properties:
ServiceToken: !Ref MyLambdaFunction
```

In the above example, "AWS::Initiator" could be a pseudo-parameter that resolves to the user/role that triggered the change. The reason why this must be specified on a separate block like Metadata (instead of passing as a property to the custom resource) is to give the custom resource provider confidence that the data is accurate - i.e. that user 'Bob' isn't trying to appears as if the request came from user 'John'.

In addition to that, a complimentary feature would be to pass down the credentials of the "initiator" down to the custom resource (perhaps similarly to how CloudFormation [impersonates the user](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template-macros.html#template-macros-permissions) to run macros). This would allow the Custom Resource provider to perform actions using the same credentials as the invoking user, like it happens with native requests.

No repository files, tests, or implementation entry points are mentioned. Start by reviewing how AWS::CloudFormation::CustomResource events are defined and delivered, then clarify the supported initiator data and credential-safety requirements; done would mean an agreed, documented feature design with a verifiable event contract.

Written by the indexing model from the issue text.