aws-cdk-lib/aws-dynamodb: replicationRegions generate lots of AccessDenied errors in CloudTrail log

### Describe the bug

When deploying, updating dynamodb table with replica regions, I observe access denied errors in cloud trail log

### Expected Behavior

No access denied errors in cloudtrail log

### Current Behavior

Bunch of AccessDenied errors generated during creation of a global table, also when adding/removing replica region, or removing whole table.

There are no errors in lambda logs or cloudformation stack events. Table construct works well with global tables.

However, these access denied errors trigger alarms we have for [CIS control 3.1](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls.html#securityhub-cis-controls-3.1)

### Reproduction Steps

1. Deploy the following stack:
```
class DynamoDbReplicaAccessDeniedDemo extends Stack {

constructor(scope: Construct, id: string, props?: StackProps) {

super(scope, id, props);

new Table(this, 'DemoTable', {
partitionKey: {
name: 'keyA',
type: AttributeType.STRING
},
replicationRegions: ['us-west-1', 'us-west-2', 'us-east-2', 'eu-central-1', 'eu-west-1', 'eu-west-2', 'eu-west-3', 'ap-southeast-1', 'ap-southeast-2', ]
})
}
}

new DynamoDbReplicaAccessDeniedDemo(app, 'ddb-replica-access-denied-demo', {
env: {
region: 'us-east-1'
}
});
```

2. Wait 15 minutes
3. Query CloudTrail log group with CloudWatch Logs Insights:
```
fields eventTime, awsRegion, eventName, userIdentity.arn, errorCode, errorMessage, @message
| filter eventName='DescribeTable' and errorCode like /AccessDenied/
| sort eventTime desc
| limit 2000
```
4. Notice there are bunch of AccessDenied errors like
> User: arn:aws:sts:::assumed-role/ddb-replica-access-denied-IsCompleteHandlerService-XXXXXXXXX/ddb-replica-access-denied-IsCompleteHandlerYYYYYY-ZZZZZZZZZZ is not authorized to perform: dynamodb:DescribeTable on resource: arn:aws:dynamodb:us-east-2::table/ddb-replica-access-denied-demo-DemoTableXXXXXXX-PPPPPPPPPP because no identity-based policy allows the dynamodb:DescribeTable action

coming from all replica regions

### Possible Solution

onEventHandler has dynamodb permissions in replica regions, while isCompleteHandler does not:
https://github.com/aws/aws-cdk/blob/433a1fada0d8091181e5c362c6d025382a40f994/packages/%40aws-cdk/aws-dynamodb/lib/table.ts#L1664

I suppose that the assumption was that calling DescribeTable in a region X will require only permissions in region X. However, it looks like AWS under the hood invokes DescribeTable in every replica region for global tables.

### Additional Information/Context

_No response_

### CDK CLI Version

2.38.1 (build a5ced21)

### Framework Version

_No response_

### Node.js Version

v14.20.0

### OS

GNU/Linux

### Language

Typescript

### Language Version

4.7.4

### Other information

_No response_