sagemaker: Support network isolation for models

### Describe the feature

As described in [the SageMaker `Endpoint` L2 construct RFC](https://github.com/aws/aws-cdk-rfcs/blob/master/text/0431-sagemaker-l2-endpoint.md#feature-additions):

> [Network Isolation][network-isolation]: The `EnableNetworkIsolation` Cloudformation boolean flag (defaults to false) on a model resource prevents inbound and outbound network calls to/from the model container.

[network-isolation]: https://aws.amazon.com/blogs/security/secure-deployment-of-amazon-sagemaker-resources/

**Please 👍 this issue to help with the prioritization of this feature.**

### Use Case

"_`EnableNetworkIsolation` – Set this to true when creating training, hyperparameter tuning, and inference jobs to prevent situations like malicious code being accidentally installed and transferring data to a remote host._" ([link](https://aws.amazon.com/blogs/security/secure-deployment-of-amazon-sagemaker-resources/))

### Proposed Solution

As described in [the SageMaker `Endpoint` L2 construct RFC](https://github.com/aws/aws-cdk-rfcs/blob/master/text/0431-sagemaker-l2-endpoint.md#feature-additions):

> Incorporating such an attribute into the Model L2 construct should not conflict with any proposed API.

### Other Information

_No response_

### Acknowledgements

- [ ] I _may_ be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.54.0-alpha.0

### Environment details (OS name and version, etc.)

macOS Ventura

Start with the SageMaker Endpoint L2 construct RFC, especially its feature-additions section, then locate the SageMaker Model L2 construct and its CloudFormation model resource handling. Confirm how the EnableNetworkIsolation boolean should be exposed and verify that a model can synthesize with the flag enabled; done means the generated resource includes the setting without conflicting with the proposed API.

Written by the indexing model from the issue text.