Log Alarm L2 Construct

## Description

Add a `LogAlarm` L2 construct to `aws-cdk-lib/aws-cloudwatch` so customers can define CloudWatch **log alarms** (alarms evaluated against the results of a scheduled CloudWatch Logs query) in CDK, without hand-writing the `AWS::CloudWatch::LogAlarm` L1 resource.

A log alarm runs a scheduled Logs query (query string + aggregation over one or more log groups) and compares the aggregated result against a threshold using an M-out-of-N evaluation. It can also surface matching log lines in the alarm notification. The construct extends `AlarmBase` (like `Alarm`, `CompositeAlarm`, and `PromQLAlarm`), reuses the existing `ComparisonOperator`/`TreatMissingData` enums, and is interchangeable anywhere an `IAlarm` is accepted.

Related: PromQL Alarm L2.

**Proposed by:** @rodrigotuna

Start in aws-cloudwatch by reading AlarmBase and the related Alarm, CompositeAlarm, and PromQLAlarm constructs, then review the AWS::CloudWatch::LogAlarm L1 resource. Check how ComparisonOperator, TreatMissingData, and IAlarm are used. Done means a documented LogAlarm L2 construct supports the stated query, threshold, evaluation, and notification behavior.

Written by the indexing model from the issue text.