(custom-resources): ResponseURL visible in StepFunctions state

### Describe the bug

The `ResponseURL` is visible in the execution state of the StepFunctions state machine, and could be used by an attacker who is able to list the executions to falsify the custom resource result. Security has deemed this a medium priority security issue that needs attention.

------

# Solution

* Write the `ResponseURL` to SSM Parameter Store as a SecretStringValue instead of keeping it in the state.
* Read it from there as well.

Niggly details

* There may be multiple executions at the same time so the exact parameter value should be unique and the reference stored in the state instead.
* Don't forget to clean up the value at the end (but don't fail the deployment if this fails)
* We should limit the permissions of the Lambda execution role, probably to something like `arn:aws:ssm:us-east-2:123456789012:parameter/cdk/custom-resource-provider/${`[`aws:userid`](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable)`}/*` (though `this.node.addr` instead might be good enough as well)

--------

While we're at it, might as well get rid of passing `ResponseURL` to user handlers based on a feature flag.

### Expected Behavior

See above.

### Current Behavior

See above.

### Reproduction Steps

See above.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

-

### Framework Version

_No response_

### Node.js Version

-

### OS

-

### Language

Typescript, Python, .NET, Java, Go

### Language Version

_No response_

### Other information

_No response_

Start by tracing how the custom-resource provider stores the ResponseURL in the StepFunctions execution state and how the Lambda execution role accesses it. Review the state machine, SSM Parameter Store SecretStringValue, concurrent-execution naming, cleanup path, and user-handler feature flag. Done means the URL is no longer exposed in execution state, concurrent executions remain distinct, cleanup failures do not fail deployments, and permissions are limited.

Written by the indexing model from the issue text.