custom-resources: aws-custom-resource to fail based on AWS SDK call response payload

### Describe the feature

Enable configuring `aws-custom-resource` provider to fail based on the AWS SDK response payload.

### Use Case

Currently `aws-custom-resource` provider will fail, if the AWS SDK call fails technically (e.g. the called resource does not exist). But there is no way to fail the provider, if the called resource returned an error in the AWS SDK call response payload.

For instance, we have a lambda as custom resource that applies DB changes during the deployment, and we need the deployment to stop/fail if the DB changes fail. But from `aws-custom-resource` provider point of view, the AWS SDK call is considered a success, although the response payload contains `FunctionError` field.

### Proposed Solution

Add property to [`AwsCustomResourceProps`](https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/custom-resources/lib/aws-custom-resource/aws-custom-resource.ts#L251), and pass it to custom resource provider function [the same way](https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/custom-resources/lib/aws-custom-resource/aws-custom-resource.ts#L420) as AWS SDK call properties.
```
/**
* The AWS SDK call response payload key that will make the custom resource
* fail, if the value is set
*
* @default - error keys in the AWS SDK call response payload are ignored
*/
readonly responseFailureKey?: string;
```
In the end of [`aws-custom-resource`](https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/custom-resources/lib/aws-custom-resource/runtime/index.ts#L218) provider function, make it fail if the response contains the defined key.
```
export async function handler(event: AWSLambda.CloudFormationCustomResourceEvent, context: AWSLambda.Context) {
...
const responseFailureKey = event.ResourceProperties.ResponseFailureKey
if (responseFailureKey && data[responseFailureKey]) {
await respond('FAILED', responseFailureKey, physicalResourceId, data)
} else {
await respond('SUCCESS', 'OK', physicalResourceId, data)
}
} catch (e) {
console.log(e);
await respond('FAILED', e.message || 'Internal Error', context.logStreamName, {});
}
```
We've used this solution successfully multiple times, though instead of the `responseFailureKey` we've just hard-coded `FunctionError` as the expected failure indicator key in the provider implementation, but the key is generally dependent on the called resource type.

### Other Information

_No response_

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.22.0

### Environment details (OS name and version, etc.)

Linux

Start with packages/@aws-cdk/custom-resources/lib/aws-custom-resource/aws-custom-resource.ts, especially AwsCustomResourceProps and the provider properties passed around line 420. Then read packages/@aws-cdk/custom-resources/lib/aws-custom-resource/runtime/index.ts near the handler response; done means a configured response key causes a matching AWS SDK payload to produce a FAILED custom-resource response, while absent or nonmatching keys retain success behavior.

Written by the indexing model from the issue text.