Force resolve dynamic secret references in change set creation

## 1. Title

Force resolve dynamic secret references in change set creation

## 2. Scope of request

Currently, if you have a dynamic reference to a secret, *and don't specify the version*, change set creation fails with the error message stating that there are no changes to the template, even if the secret value changed.

It would be great if we could pass either a flag or a capability to change set creation to force CloudFormation to detect and re-resolve dynamic references to secrets when you want the latest version of the secret.

We use a lot of CodePipeline, and for us, it is especially necessary for this to be supported by the CHANGE_SET_REPLACE CloudFormation action.

## 3. Expected behavior

When I leave off the version of a secret, it means I want to use the latest version, and that means when I change the secret value, I expect a change set to be created and for the change set to use the updated value.

## 4. Suggest specific test cases

Say you have a reference in a template Foo like so:
{{resolve:secretsmanager:MySecret:SecretString:password}}

1. Go to SecretsManager
1. Retrieve and edit the password for MySecret
1. Create a change set for Foo (management console or CLI)
--> Change set should be created and executed with the new password

Currently, change set creation fails.

## 5. Helpful Links to speed up research and evaluation

* https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html#dynamic-references-secretsmanager
* https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets-create.html
* https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-CloudFormation.html
* https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_cloudformation.html

## 6. Category (required) - Will help with tagging and be easier to find by other users to +1

Security, Developer Tools, Enhancement