AWS::CertificateManager::Certificate - Resource deletion fails when using DomainValidationOptions

## 1. Title
AWS::CertificateManager::Certificate - Resource deletion fails when using DomainValidationOptions

## 2. Scope of request
AWS::CertificateManager::Certificate with DomainValidationOptions allows automated validation of certificates via Route53 records on a HostedZone.

However, deleting the AWS::CertificateManager::Certificate does not remove the validation records from the Route53 HostedZone.

This prevents CloudFormation from being able to delete the HostedZone and thus the stack itself.

## 3. Expected behavior

Deleting the AWS::CertificateManager::Certificate resource should delete the validation records and allow the HostedZone to be deleted.

## 4. Suggest specific test cases

Here's an example that creates a new HostedZone, updates its parent HostedZone to reflect the new HostedZone's nameservers, and finally creates an AWS::CertificateManager::Certificate in the new hosted zone using domain validation via a CNAME record:

```yaml
AWSTemplateFormatVersion: 2010-09-09

Parameters:
HostedZoneName:
Description: Full host name for the DNS zone, e.g. foo.example.com
Type: String
ParentHostedZoneId:
Description: Route53 HostedZoneId of the parent of the to be created HostedZoneName, e.g. Z0123456789ABCDEFGHIJ
Type: String

Resources:
HostedZone:
Type: AWS::Route53::HostedZone
Properties:
Name: !Sub "${HostedZoneName}."

HostedZoneNSRecords:
Type: AWS::Route53::RecordSetGroup
Properties:
HostedZoneId: !Sub "${ParentHostedZoneId}"
RecordSets:
- Name: !Sub "${HostedZoneName}."
Type: NS
TTL: "60"
ResourceRecords: !GetAtt HostedZone.NameServers

Certificate:
Type: "AWS::CertificateManager::Certificate"
Properties:
DomainName: !Sub "*.${HostedZoneName}"
DomainValidationOptions:
- DomainName: !Sub "*.${HostedZoneName}"
HostedZoneId: !Ref HostedZone
ValidationMethod: DNS
```

Attempting to delete this stack fails at deleting the HostedZone with the error:

> The specified hosted zone contains non-required resource record sets and so cannot be deleted. (Service: Route53, Status Code: 400, Request ID: ec406264-50ae-4f5a-96dd-4d451e207aaf, Extended Request ID: null)

Manually deleting the the domain validation CNAME prior to deleting the CloudFormation stack allows the deletion of the stack to succeed.

## 5. Helpful Links to speed up research and evaluation

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-certificatemanager-certificate.html

https://docs.aws.amazon.com/acm/latest/userguide/dns-validation.html

## 6. Category (required) - Networking & Content

Start with the CloudFormation certificate resource documentation and the supplied template, then reproduce the stack deletion failure involving DomainValidationOptions and a Route53 HostedZone. Done means deleting the certificate removes its DNS validation CNAME records so the HostedZone and stack delete without manual cleanup.

Written by the indexing model from the issue text.