Custom Domains: publish certificate validation records in App Runner managed zones

**Community Note**
* Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do * not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Setting up a Custom Domain requires these records to be added to DNS:
- a CNAME or ALIAS record for the custom domain (`example.com` -> `xyz.awsapprunner.com`)
- CNAME records for some subdomains for certificate validation ( `_123.example.com`, `_123.abc.example.com` -> `_456.acm-validations.aws`)

If a CNAME is used for the domain (`example.com`), then DNS queries for the certificate validation records (`_123.example.com`) are resolved against the AppRunner DNS zone (`xyz.awsapprunner.com`). So, it is not possible to validate the certificate and have a domain CNAME in place (which is the only option if your DNS service does not support arbitrary ALIAS records).

To resolve this, when Custom Domain is added, App Runner should publish CNAME records in its managed zone that point to the certificate validation records ( `_123.xyz.awsapprunner.com`, `_123.abc.xyz.awsapprunner.com` -> `_456.acm-validations.aws`). This would allow users to configure Custom Domains in situations where using an ALIAS record is not available--I know this is currently a problem for Route53 and namecheap.com (due to a character count limit).

**Describe alternatives you've considered**
To work around this I have used a wildcard for the Custom Domain (`*.example.com`), which allows me to publish validation records at a lower level (`_123.example.com`), and used a subdomain (`myapp.example.com`) for the CNAME to the App Runner service.

This is OK if a) there isn't a requirement to use the base domain (`example.com`) for the app and b) the organization is happy to have a wildcard certificate (`*.exmaple.com`) issued when only a subdomain certificate is needed (`myapp.example.com`).

However, this workaround does not work correctly if you want to have more than one App Runner service. If two app runner services are configured with a wildcard Custom Domain (`*.example.com`), App Runner routes all traffic for any subdomains (`myapp.exmaple.com`, `yourapp.example.com`) to just one of them (based on which was there first, or which comes first alphabetically or something).

No repository files, tests, or implementation entry points are identified. Start by reviewing the App Runner custom-domain flow and managed DNS zone behavior described in the issue, including certificate validation records and multiple wildcard services. Done would allow custom domains using CNAME records where arbitrary ALIAS records are unavailable, without breaking routing between services.

Written by the indexing model from the issue text.