add support for excluding custom resource Lambda functions from Inspector scans

### Describe the feature

AWS Inspector costs 30 cents per month per Lambda for standard scanning, and 60 cents per month per Lambda function for code scanning. Due to CDK's reliance on custom resources for several common features, such as setting the log group retention for a Lambda function, the number of CDK-owned functions that we don't care to scan can quickly add up, which adds to the Inspector bill.

AWS Inspector allows us to exclude specific Lambda functions from these scans by tagging them with InspectorExclusion= LambdaStandardScanning and InspectorCodeExclusion=LambdaCodeScanning. However, since CDK creates these custom resource Lambda functions behind the scenes, applying these tags is cumbersome.

Please add support for automatically including these tags on all custom resource Lambda functions that are created internally by CDK.

### Use Case

See above.

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.74.0

### Environment details (OS name and version, etc.)

Alpine 3.17

No file, test, or entry point is named. Start by locating the code that creates CDK-owned custom-resource Lambda functions and the existing path for applying function tags; then identify coverage for both Inspector exclusion tags. Done means synthesized templates include the requested tags on every internally created custom-resource function.

Written by the indexing model from the issue text.