@aws-cdk/aws-elasticsearch: Allow retrieve the generated app client id when creating an ElasticSearch service

### Describe the feature

I need to retrieve the ES generated app client id, to be able to add role mapping

### Use Case

When I configure an ES domain to use Amazon Cognito authentication for Kibana, ES adds an app client to the user pool. I need to retrieve the app client id, to be able to add role mapping. More specifically, I need to change the authenticated role selection to type token instead of the default option. In CDK, I can do that like this:
```
new CfnIdentityPoolRoleAttachment(this, 'RoleAttachment', {

...

roleMappings: {

'app client id here': {
type: 'Token',
ambiguousRoleResolution: 'AuthenticatedRole'
}
},
...
});
```

I saw some recommendations in these 2 articles:
[https://github.com/aws/aws-cdk/issues/7119](https://github.com/aws/aws-cdk/issues/7119)
[aws-samples](https://github.com/aws-samples/amazon-elasticsearch-service-with-cognito/blob/main/lib/search-stack.ts)

unfortunately, I can't use them, because we creating a few clusters in CDK and we have some other app clients,
and probably I can't rely on the app client index in the user pool

```
const userPoolClients = new AwsCustomResource(this, 'clientIdResource', {
policy: AwsCustomResourcePolicy.fromSdkCalls({ resources: [userPool.attrArn] }),
onCreate: {
service: 'CognitoIdentityServiceProvider',
action: 'listUserPoolClients',
parameters: {
UserPoolId: userPool.ref
},
physicalResourceId: PhysicalResourceId.of(`ClientId-${applicationPrefix}`)
}
});
userPoolClients.node.addDependency(esDomain);

const clientId = userPoolClients.getResponseField('UserPoolClients.0.ClientId');
const providerName = `cognito-idp.${this.region}.amazonaws.com/${userPool.ref}:${clientId}`
```

Is there another way how I can get it ?

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

1.147.0

### Environment details (OS name and version, etc.)

Windows 11

Start at the @aws-cdk/aws-elasticsearch construct and its domain creation flow, then compare the generated app client with CfnIdentityPoolRoleAttachment.roleMappings. Determine how the construct can expose the exact client ID when multiple clusters and user-pool clients exist. Done means consumers can use that ID for the Token role mapping without relying on client ordering.

Written by the indexing model from the issue text.