(cli): shell out to changeset approver tool

### Description

Shell out to external tools for change approval during `cdk deploy`.

### Use Case

Allow people to integrate their own tools into `cdk deploy`, so they can customize the approval logic (and/or UI) without having to go through us).

### Proposed Solution

Add a `--changeset-approval-tool=xyz` flag. This flag will supersede the built-in change approval modes and work as follows:

- After creating the changeset (assuming it's non-empty), shell out to the given command, with AWS credentials in the environment and the changeset ID as an argument. Run the equivalent of:

```
AWS_ACCESS_KEY_ID=*** AWS_SECRET_KEY=*** AWS_SESSION_TOKEN=*** xyz arn:aws:....:stack/MyStack/11111-22222-ccccc/my-change-set
```

If the tool exits with exit code 0, continue.

Otherwise, abort.

### Other information

_No response_

### Acknowledge

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

Start at the cdk deploy command and trace changeset creation and the existing approval modes. Verify that the proposed flag invokes the external command with the changeset ID and AWS credentials, and that deployment continues only on exit code 0; the work is done when nonzero exits abort deployment.

Written by the indexing model from the issue text.