OpenSearch: New Custom Domain not added to Cognito App Client for Existing Deployments

### Describe the bug

Adding a custom domain after an existing OpenSearch deployed with a Cognito Userpool won't update the App Client generated by OpenSearch, and causes the login to fail on the new URL.

### Expected Behavior

App Client "Allowed callback URLs" and "Allowed sign-out URLs" is updated to include the new domain.

### Current Behavior

App Client "Allowed callback URLs" and "Allowed sign-out URLs" isn't updated to include the new domain, which causes logins from the new domain to fail.

### Reproduction Steps

1. Deploy OpenSearch with Cognito but no Custom Domain
2. Redeploy, but with Custom Domain
3. Attempt Sign-In at new Domain.

First Deploy Without Custom Domain
> const opensearch = new cdk.aws_opensearchservice.Domain(this, "os", {
version: cdk.aws_opensearchservice.EngineVersion.openSearch("1.3"),
domainName: "example",
fineGrainedAccessControl: { masterUserArn },
nodeToNodeEncryption: true,
encryptionAtRest: { enabled: true },
enforceHttps: true,
enableVersionUpgrade: true,
tlsSecurityPolicy: cdk.aws_opensearchservice.TLSSecurityPolicy.TLS_1_2,
cognitoDashboardsAuth: { userPoolId, identityPoolId, role },
removalPolicy: cdk.RemovalPolicy.DESTROY,
...opensearch_branch_settings,
})

Second Deploy With Custom Domain
> const opensearch = new cdk.aws_opensearchservice.Domain(this, "os", {
version: cdk.aws_opensearchservice.EngineVersion.openSearch("1.3"),
domainName: "example",
fineGrainedAccessControl: { masterUserArn },
nodeToNodeEncryption: true,
encryptionAtRest: { enabled: true },
enforceHttps: true,
enableVersionUpgrade: true,
tlsSecurityPolicy: cdk.aws_opensearchservice.TLSSecurityPolicy.TLS_1_2,
cognitoDashboardsAuth: { ... },
customEndpoint: { domainName: "opensearch.example.com.au", hostedZone, certificate },
removalPolicy: cdk.RemovalPolicy.DESTROY,
...opensearch_branch_settings,
})

### Possible Solution

Add a check to see if the App Client needs to be updated when the resources changes.

### Additional Information/Context

_No response_

### CDK CLI Version

2.34.2

### Framework Version

_No response_

### Node.js Version

v16.15.1

### OS

Amazon Linux 2

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Start at the aws_opensearchservice.Domain entry point with cognitoDashboardsAuth and customEndpoint, tracing how an existing deployment is updated. Reproduce the two-deployment scenario and verify that adding a custom domain updates the Cognito App Client's allowed callback and sign-out URLs so sign-in succeeds at the new URL.

Written by the indexing model from the issue text.