(lambda-event-sources): (Improve configuring authentication in SelfManagedKafkaEventSourceProps)

### Describe the feature

In AWS its possible to configure a self hosted Kafka as an eventsource for a Lambda, described [here](https://docs.aws.amazon.com/lambda/latest/dg/with-kafka.html#services-smaa-topic-add).

Theres a variety of ways how to authenticate against your kafka cluster (vpc, certificates, root-ca or a combination of these).

During the review of #21422 we (@TheRealAmazonKendra, @mrgrain) came to the conclusion that the `SelfManagedKafkaEventSourceProps` could take an overhaul on how to configure authentication (this includes, vpc + authentication method + rootCACertificate) in these props.

### Use Case

When configuring a Kafka Eventsource Trigger for your Lambda on the aws console/ui its easier than with cdk.

There is a combination of required values, which isnt obvious through use of the cdk code (for example you required to either configure a vpc or a secret, but both are declared as optional values in the props). This could be simplified and could make the live of the dev easier.

### Proposed Solution

This is the rough proposed idea/solution which can be more improved/discussed (there is already some feedback in there).

https://gist.github.com/WtfJoke/bd20e0bf74d77a158f41970204560ee4

This change would most likely result in some sort of a breaking change and would need some sort of feature flag.

### Other Information

https://github.com/aws/aws-cdk/pull/21422

### Acknowledgements

- [X] I may be able to implement this feature request
- [X] This feature might incur a breaking change

### CDK version used

v2.35.0

### Environment details (OS name and version, etc.)

windows 11 (wsl)

Start by reading the SelfManagedKafkaEventSourceProps API and the discussion in #21422, then compare the proposed shape in the linked gist with AWS's self-managed Kafka Lambda authentication documentation. Define the supported VPC, authentication, and root CA combinations, including how the breaking change or feature flag is handled; done means the configuration is explicit and usable for the documented authentication cases.

Written by the indexing model from the issue text.