Role: Potential future bug with grantAssumeRole

### Describe the bug

https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_iam.Role.html#grantwbrassumewbrroleidentity
Currently, grantAssumeRole works by adding an IAM::Policy rather than adding a trust role.

This is because roles implicitly trusted themselves from a role trust policy perspective if they had identity-based permissions to assume themselves.[1]

However, this will not work after June 30, 2023 since roles will no longer implicitly trust themself.
[1]https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/

### Expected Behavior

Make a custom resource that will add the principal to the trust policy **after** the role has been created.

### Current Behavior

Currently, this works

constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);

const testRole = new iam.Role(this, 'TestRole', {
assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com')
});
//Trust itself
testRole.grantAssumeRole(testRole);
}


But it will adds an IAM::Policy instead of create a trust policy. Which will not work after June.
https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/

Resources:
TestRole6C9272DF:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: lambda.amazonaws.com
Version: "2012-10-17"
Metadata:
aws:cdk:path: CdktestStack/TestRole/Resource
TestRoleDefaultPolicyD1C92014:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Resource:
Fn::GetAtt:
- TestRole6C9272DF
- Arn
Version: "2012-10-17"
PolicyName: TestRoleDefaultPolicyD1C92014
Roles:
- Ref: TestRole6C9272DF

### Reproduction Steps

1. constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);

const testRole = new iam.Role(this, 'TestRole', {
assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com')
});

testRole.grantAssumeRole(testRole);
}

### Possible Solution

Create a custom resource.

### Additional Information/Context

_No response_

### CDK CLI Version

2.69.0 (build 60a5b2a)

### Framework Version

_No response_

### Node.js Version

v18.15.0

### OS

Windows 11

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Start at the Role.grantAssumeRole entry point and compare its current synthesized AWS::IAM::Policy with the role's AssumeRolePolicyDocument shown in the issue. Done means the self-assume grant remains valid under the stated AWS trust-policy change, with the generated resources reflecting the expected post-creation trust behavior.

Written by the indexing model from the issue text.