aws-secretsmanager: Malformed IAM Policy Resource for CodeBuildAction referencing secret name

In the Python app below a Secret is created and then referenced in the environment configuration for a CodeBuildAction. Trying to deploy this results in a `MalformedPolicyDocument` error. Sure enough, this is output in `cdk.out/Build.template.json` in the resource `BuildProjectRoleDefaultPolicy`:

```json
{
"Action": "secretsmanager:GetSecretValue",
"Effect": "Allow",
"Resource": "${Token[Fn"
}
```

It appears something went wrong in referencing the secret name. When i switch to the secret ARN instead, though, it works fine. According to the [documentation](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-codebuild.BuildEnvironmentVariable.html#properties), either the secret name or ARN should work.

### Reproduction Steps

Run `cdk synth` for this Python app:

```py
#!/usr/bin/env python3
from aws_cdk import \
aws_codebuild as cb, \
aws_secretsmanager as secrets, \
aws_codepipeline_actions as actions, \
aws_codepipeline as cp, \
core as cdk

class MyPipelineStack(cdk.Stack):

def __init__(self, scope: cdk.Construct, construct_id: str, **kwargs) -> None:
super().__init__(scope, construct_id, **kwargs)

pipeline = cp.Pipeline(self, 'MyPipeline')

source_stage = pipeline.add_stage(stage_name='Source')
build_stage = pipeline.add_stage(stage_name='Build')

source_artifact = cp.Artifact(f'SourceArtifact')
source_action = actions.CodeStarConnectionsSourceAction(
action_name='SourceGitHub',
connection_arn='arn:aws:codestar-connections:us-east-1:0000000000:connection/00000000-0000-0000-0000-000000000000',
output=source_artifact,
owner='BrettHoutz',
repo='myrepo',
)
source_stage.add_action(source_action)

access_token_secret = secrets.Secret(self, 'AccessToken')
project = cb.PipelineProject(self, 'BuildProject')
build_action = actions.CodeBuildAction(
action_name='Build',
input=source_artifact,
project=project,
environment_variables={
'ACCESS_TOKEN': {'type': cb.BuildEnvironmentVariableType.SECRETS_MANAGER, 'value': access_token_secret.secret_name},
}
)

build_stage.add_action(build_action)

app = cdk.App()
MyPipelineStack(app, 'Build')
app.synth()
```

### What did you expect to happen?

Synthesize a stack with a valid policy

### What actually happened?

Policy has an invalid Resource field

### Environment

- **CDK CLI Version : 1.116.0**
- **Framework Version: 1.116.0**
- **Node.js Version: 10.15.3**
- **OS : macOS 10.15.7 Catalina**
- **Language (Version): Python 3.8.2**

---

This is :bug: Bug Report

Start by running cdk synth for the Python reproduction and inspect cdk.out/Build.template.json, especially BuildProjectRoleDefaultPolicy. Trace how CodeBuildAction consumes access_token_secret.secret_name versus the ARN; done means synthesis produces a valid Resource policy field and the stack can deploy.

Written by the indexing model from the issue text.