aws-cdk-lib/aws-ecs-patterns: ALB services, option to only forward requests with the expected host

### Describe the feature

Option to only forward requests where the host header matches the `domainName` set for the `ApplicationLoadBalanced(Ec2/Fargate)Service`.

### Use Case

We noticed we were getting lots of requests hitting the workload with the wrong host header. This is because, even though we are setting the domain name (https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecs_patterns.ApplicationLoadBalancedEc2Service.html#domainname), the ALB still forwards everything to the workload.

### Proposed Solution

My suggestion is for an option like `enforceHostHeader?: boolean` that, if set, changes the rules on the ALB listener to be:
- if host header matches the domainName, then forward to the target group
- default action: serve a 400 bad request

This differs from the default listener behaviour which is just:
- default action: forward to the target group

I suppose there's a case to be made that `enforceHostHeader: true` should be the default behaviour when `domainName` is set, but this would be a breaking change.

### Other Information

I have escape-hatched this as follows:
```typescript
const myDomainName = 'mydomain.example.com';
const myService = new ecsPatterns.ApplicationLoadBalancedEc2Service(this, `MyService`, {
// ...
domainName: myDomainName,
openListener: true,
protocol: elbv2.ApplicationProtocol.HTTPS,
redirectHTTP: true,
});

myService.listener.addAction('ForwardIfMatchingDomain', {
priority: 10,
conditions: [
elbv2.ListenerCondition.hostHeaders([myDomainName]),
],
action: elbv2.ListenerAction.forward([myService.targetGroup]),
});
const cfnListener = myService.listener.node.defaultChild as elbv2.CfnListener;
cfnListener.addPropertyOverride('DefaultActions', [{
Type: 'fixed-response',
FixedResponseConfig: {
ContentType: 'text/plain',
MessageBody: 'Bad Request',
StatusCode: '400',
},
}]);
```

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.54.0

### Environment details (OS name and version, etc.)

n/a

Start at ApplicationLoadBalancedEc2Service and the corresponding Fargate service, then trace how the listener, target group, domainName, and openListener options are configured. Compare the proposed host-header rule and fixed 400 default action with the escape-hatch example. Done means an opt-in enforceHostHeader option forwards matching hosts and returns 400 for other requests without changing existing defaults.

Written by the indexing model from the issue text.