(core): enable adding `sts:SetSourceIdentity` to bootstrap stack trust policy for monitored environments

### Description

In [monitored AWS accounts](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html) it's required for the user to add `sts:SetSourceIdentity` to the trust policy of the cdk-toolkit iam roles.

If not done the deployment does not fail, however the log is spammed with:
```
current credentials could not be used to assume 'arn:aws:iam::************:role/cdk-hnb659fds-lookup-role-************-region', but are for the right account. Proceeding anyway.
```

### Use Case

Using CDK in monitored environments

### Proposed Solution

provide a flag or another way how to modify the trust policy

### Other information

I'd be willing to implement this, however I'd need some guidance where to start, since I couldn't find the place where the trust policy is built

### Acknowledge

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

No files, tests, or entry points are named. Start by locating the code that builds the CDK toolkit IAM roles' bootstrap trust policies, then determine how a user-controlled flag or equivalent could add sts:SetSourceIdentity for monitored AWS accounts. Done means the generated trust policy includes the action when enabled without changing the default behavior.

Written by the indexing model from the issue text.