[s3] S3 Bucket Notification custom resource cannot be used with VPC

Adding an S3 bucket notification fails deployment if the S3 bucket policy restricts traffic to a VPC.

### Reproduction Steps

```
### Given some VPC in a stack, e.g.

const vpc = new ec2.Vpc(stack, `vpc`, {
cidr: ec2.Vpc.DEFAULT_CIDR_RANGE,
enableDnsHostnames: true,
enableDnsSupport: true,
natGateways: 1,
subnetConfiguration: [
{
cidrMask: 24,
name: `isolated-subnet`,
subnetType: ec2.SubnetType.ISOLATED,
},
{
cidrMask: 24,
name: `private-subnet`,
subnetType: ec2.SubnetType.PRIVATE,
},
{
cidrMask: 24,
name: `public-subnet`,
subnetType: ec2.SubnetType.PUBLIC,
},
],
});

const s3Endpoint = vpc.addGatewayEndpoint(`s3-vpce`, {
service: ec2.GatewayVpcEndpointAwsService.S3,
subnets: [{ subnetType: ec2.SubnetType.PRIVATE }],
});

### Given a stack, some id, and some properties
const bucket = new s3.Bucket(scope, id, props);
bucket.addToResourcePolicy(
new iam.PolicyStatement({
sid: 'DenyAllNonVPCTraffic',
actions: ['s3:*'],
effect: iam.Effect.DENY,
principals: [new iam.AnyPrincipal()],
resources: [`${bucket.bucketArn}`, `${bucket.bucketArn}/*`],
conditions: {
'ForAllValues:StringNotEquals': {
'aws:sourceVpce':[s3Endpoint.vpcEndpointId],
'aws:PrincipalArn': vpcEndpointExceptionRoles /*CloudFormation deployment role*/,
},
},
})
)

# Given some lambda function
bucket.addEventNotification(s3.EventType.OBJECT_CREATED, new s3Notifications.LambdaDestination(lambdaFn));

# Deploying fails
```

### What did you expect to happen?

S3 Notification should have been attached to the bucket during CFN deployment.

### What actually happened?

The S3Notification CustomResource attempts to action against the s3 bucket and gets denied permission, specifically `Failed to create resource. Access Denied`

### Environment

- **CLI Version :** aws-cli/2.0.44
- **Framework Version:** 1.63.0
- **Node.js Version:** v12.10.0
- **OS :** MacOS
- **Language (Version):** TS 3.9.6

### Other

While it's understandable that this failed, maybe as a solution there should be a mechanism to provide a VPCe to the bucket notification method so that the [CustomResource](https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource-handler.ts) can be attached to said VPC and then act accordingly.

---

This is :bug: Bug Report

Start with packages/@aws-cdk/aws-s3/lib/notifications-resource/notifications-resource-handler.ts and reproduce the deployment using an S3 gateway endpoint and a bucket policy restricted to the VPC endpoint. Trace why the S3Notification custom resource is denied, then verify that the notification attaches successfully during CloudFormation deployment without weakening the bucket policy.

Written by the indexing model from the issue text.