(acm): Ability to generate and import self-signed certificates to ACM

### Describe the feature

Like [the feature implemented on Terraform](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/acm_certificate#existing-certificate-body-import), we'd like to generate a self-signed certificate within CDK, and import it to ACM.

The API on Terraform is like below. We can basically follow this design.

```tf
resource "tls_private_key" "example" {
algorithm = "RSA"
}

resource "tls_self_signed_cert" "example" {
key_algorithm = "RSA"
private_key_pem = tls_private_key.example.private_key_pem

subject {
common_name = "example.com"
organization = "ACME Examples, Inc"
}

validity_period_hours = 12

allowed_uses = [
"key_encipherment",
"digital_signature",
"server_auth",
]
}

resource "aws_acm_certificate" "cert" {
private_key = tls_private_key.example.private_key_pem
certificate_body = tls_self_signed_cert.example.cert_pem
}
```

### Use Case

Currently we cannot create an ACM certificate without 1. creating a Route 53 hosted zone or 2. creating a private certificate authority ([doc](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_certificatemanager-readme.html#requesting-private-certificates)). When I want to quickly test some TLS feature, I sometimes get frustrated since creating them properly is troublesome and difficult.

Although we can generate a self-signed certificate locally and import it via the management console or AWS API, it would be really great if we could do it just using CDK.

### Proposed Solution

Because CloudFormation does not support natively to import a certificate to ACM, we have to create a custom resource construct to do that. Additionally, we need a feature to generate a TLS certificate [as in Terrafrom](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/self_signed_cert) and pass it to the custom resource.

### Other Information

Since using self-signed certificates is often not following security best practice, a warning should be clearly noted like in Terraform docs.

> Self-signed certificates are usually used only in development environments or applications deployed internally to an organization. Certificates of this type are generally not trusted by client software such as web browsers. Therefore clients are likely to generate trust warnings when connecting to a server that has a self-signed certificate.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.26.0

### Environment details (OS name and version, etc.)

macOS

Start by reviewing the CDK ACM certificate-manager entry point and the proposed custom resource construct, then compare the Terraform self-signed certificate and existing-certificate import designs linked in the issue. Done means CDK can generate a self-signed certificate, import it into ACM through the custom resource, and clearly document the development-only security warning.

Written by the indexing model from the issue text.