aws-stepfunctions-tasks: Custom resources being provisioned when passing in `subnets` to `EcsRunTask`

### Describe the bug

I'm attempting to cloudform an `EcsRunTask` (with no context file).
Not passing the `subnet` prop results in this error:
```
There are no 'Private' subnet groups in this VPC.
```

This is somewhat expected, CDK doesn't know at compile time what subnet groups are in a VPC.
Passing in an array of private subnets (whose ids are stored in an SSM param) causes CDK to provision custom resources when passing the `subnets` prop to `EcsRunTask`.

For reasons I don't fully understand, CDK attempts to cloudform a lambda to be served from an S3 bucket. The following parameters are also created:

- Asset hash
- S3 bucket name
- S3 bucket version number

Because these parameters do not have any values, it is not possible to update the stack.

### Expected Behavior

I expect CDK to reference the private subnets I'm passing to the `EcsRunTask` construct.

### Current Behavior

`synth` works as expected, but updating the stack with the newly generated template fails due to the parameters not having values.

The parameters being generated are

```
"AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0ArtifactHashAF1370F8": {
"Description": "Artifact hash for asset "28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0"",
"Type": "String",
},
"AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3BucketCD1790E7": {
"Description": "S3 bucket for asset "28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0"",
"Type": "String",
},
"AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3VersionKeyCE63AE8F": {
"Description": "S3 key for asset version "28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0"",
"Type": "String",
},
```

and the custom resource (a node lambda):
```
"AWSCDKCfnUtilsProviderCustomResourceProviderHandlerCF82AA57": {
"DependsOn": [
"AWSCDKCfnUtilsProviderCustomResourceProviderRoleFE0EE867",
],
"Properties": {
"Code": {
"S3Bucket": {
"Ref": "AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3BucketCD1790E7",
},
"S3Key": {
"Fn::Join": [
"",
[
{
"Fn::Select": [
0,
{
"Fn::Split": [
"||",
{
"Ref": "AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3VersionKeyCE63AE8F",
},
],
},
],
},
{
"Fn::Select": [
1,
{
"Fn::Split": [
"||",
{
"Ref": "AssetParameters28739348edff6f1084f6a50d8d934e2d3fc2a3bb77442d8a9a1361d51ccd03c0S3VersionKeyCE63AE8F",
},
],
},
],
},
],
],
},
},
"Handler": "__entrypoint__.handler",
"MemorySize": 128,
"Role": {
"Fn::GetAtt": [
"AWSCDKCfnUtilsProviderCustomResourceProviderRoleFE0EE867",
"Arn",
],
},
"Runtime": "nodejs16.x",
"Timeout": 900,
},
"Type": "AWS::Lambda::Function",
},
"AWSCDKCfnUtilsProviderCustomResourceProviderRoleFE0EE867": {
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com",
},
},
],
"Version": "2012-10-17",
},
"ManagedPolicyArns": [
{
"Fn::Sub": "arn:\${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
},
],
},
"Type": "AWS::IAM::Role",
},
"CdkJsonStringify2": {
"DeletionPolicy": "Delete",
"Properties": {
"ServiceToken": {
"Fn::GetAtt": [
"AWSCDKCfnUtilsProviderCustomResourceProviderHandlerCF82AA57",
"Arn",
],
},
"Value": {
"Ref": "ecstestPrivateSubnets",
},
},
"Type": "Custom::AWSCDKCfnJsonStringify",
"UpdateReplacePolicy": "Delete",
},
```

### Reproduction Steps

This is a complex construct that requires several props to be defined, so I'm including an example for our repository.

https://github.com/guardian/cdk/blob/effb29ee6aaa8cd72bd10102649991eb55067c3c/src/constructs/ecs/ecs-task.ts#L206-L223

Removing the `subnets` prop gets rid of the custom resources.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.78.0

### Framework Version

_No response_

### Node.js Version

v18.16.0

### OS

macOS Monterey 12.6.2

### Language

Typescript

### Language Version

TypeScript 4.9.5

### Other information

_No response_

Start with the reproduction in src/constructs/ecs/ecs-task.ts at lines 206-223, then synthesize it once with the subnets prop and once without it. Compare the generated custom resources and asset parameters; done means passing subnets to EcsRunTask no longer produces unusable custom-resource parameters or prevents stack updates.

Written by the indexing model from the issue text.