(core): make SecretValue.unsafePlainText() harder to use

### Describe the feature

By request of the Secrets Manager team, use of `SecretValue.unsafePlainText()` needs to be discouraged even more.

We'll add a feature flag:

```
{
"@aws-cdk/core.preventUnsafePlaintextSecrets": true
}
```

That users will have to explicitly turn off to be able to call the plaintext constructor for SecretValue.

While we're at it, let's also record metadata into the resulting CFN template that an unsafe secret was rendered literally into the template.

### Use Case

Make sure that users don't commit secrets to source control.

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

-

### Environment details (OS name and version, etc.)

-

Start by locating the SecretValue.unsafePlainText() entry point and the surrounding core implementation. Trace how configuration flags and synthesized CloudFormation templates are handled, then verify that the feature flag controls plaintext construction and that templates record when an unsafe secret is rendered literally.

Written by the indexing model from the issue text.