AWS::CloudFront::Distribution - Tags not recognized by drift detection

## 2. Scope of request

Bug?
AWS::CloudFront::Distribution - possible issue with tags and drift detection

## 3. Expected behavior

When running drift detection on an AWS::CloudFront::Distribution resource, the tags applied to the 'actual' distribution should get picked up by drift detection.
Currently, distribution tags are not properly considered, resulting in what seems to be a drift false-positive.

## 5. Helpful Links to speed up research and evaluation

I'm not sure if the CloudFront distribution type counts as 'provisionable' and 'private', but it is not explicitly included on this of resources that support drift detection.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import-supported-resources.html

If this was not a bug, and drift detection is just not supported for distribution tags, I would expect tags to just not be included in the drift report, according to this page.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html

However, tags are certainly being considered, but it seems like it's not working properly. I demonstrate this in the extra context section.

## 6. Category (required) - Will help with tagging and be easier to find by other users to +1

Use the categories as displayed in the AWS Management Console (simplified):

4. Networking & Content (VPC, Route53, API GW,...)

## 7. Any additional context (optional)

I'm not an expert at using CloudFormation by any means, and I've only recently gotten serious about using it, but this did strike me as unintended. To be sure, I asked around stackoverflow first.
https://stackoverflow.com/questions/68607418/cloudformation-incorrectly-reporting-drift-in-cloudfront-tags

The relevant definition of the distribution that I encountered this situation with:
```yaml
...
CloudFrontCDN:
Type: AWS::CloudFront::Distribution
Properties:
DistributionConfig:
Comment: Source for all static resources
PriceClass: PriceClass_100
Aliases:
- domain.com
ViewerCertificate:
AcmCertificateArn: !Ref MahCert
MinimumProtocolVersion: TLSv1.2_2021
SslSupportMethod: sni-only
DefaultRootObject: index.html
DefaultCacheBehavior:
ViewerProtocolPolicy: redirect-to-https
CachePolicyId: b2884449-e4de-46a7-ac36-70bc7f1ddd6d
TargetOriginId: SiteBucket
Enabled: True
Origins:
- DomainName: .s3.amazonaws.com
Id: SiteBucket
S3OriginConfig:
OriginAccessIdentity: ''
...
```
I can add more of the template if needed.

**All** tags seem to be ignored by drift detection. I initially encountered this issue when I noticed drift detection wasn't picking up tags inherited from the stack, but I tried to trick it by adding my own tags to the distribution. Still, any extra tags weren't getting recognized as mismatching with the expected resource definition.

Here is the tag defined at the stack level, which drift detection __expects__:

Here is that same tag *properly* applied to the managed CloudFront distribution by the stack, as well as the tag I added manually to test drift detection:

Here are the results of running drift detection in this state:
As you can see, it's picking up neither the stack-level tag, which it expects, NOR the tag that I added manually. No tags at all. It seems to think there outright aren't any tags on the distribution.

---
^{I blocked out all of the ARNs and other resource identifiers in my screenshots just to be safe. I'm not sure if that is overkill or not, but I wasn't sure if it's some kind of risk post them publicly.}