aws-iam: Make IAM.Role.defaultPolicy public

### Describe the feature

I am trying to modify the defaultPolicy in the IAM.Role construct. The default policy is a great feature - I don't have to worry too much about base permissions when instantiating constructs that manage them, etc. However, I should be able to modify _any_ CloudFormation that gets created by the CDK easily, and I can't seem to with defaultPolicy being private. Please make this public!

### Use Case

As one use-case, I'm trying to add Cfn metadata (not CDK Cfn metadata) because I want to use cfn_nag and not CDK nag to remediate some issues in a CICD scanning step (note that below is not possible today):

```
const cfnPolicy = buildProject.role?.defaultPolicy?.node.defaultChild as IAM.CfnPolicy;
cfnPolicy.addMetadata('cfn_nag', {
'rules_to_suppress': [...]
});
```

For this particular use-case, I assign some additional permissions to a CodeBuild project, then try to cfn_nag remediate the role of the CodeBuild project permissions:

```
const buildProject = new CodeBuild.PipelineProject(this, 'action', ...);
buildProject.addToRolePolicy(...);

const cfnRole = buildProject.role?.node.defaultChild as IAM.CfnRole;
cfnRole.addMetadata('cfn_nag', {
'rules_to_suppress': [..]
});
```

The CloudFormation template has my new permissions under the defaultPolicy, but my metadata shows up under a _referenced_ role, which cfn_nag doesn't seem to care for as remediating, which is just one reason I want access to the defaultPolicy:

```
stacknamemyroleconstructIAMRole4AA71546:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
...
ManagedPolicyArns:
...
Metadata:
aws:cdk:path: stack-name/root-construct/my-role-construct/IAMRole/Resource
cfn_nag:
rules_to_suppress:
- ...
stacknamemyroleconstructIAMRoleDefaultPolicyC3A13125:
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
...
PolicyName: stacknamemyroleconstructIAMRoleDefaultPolicyC3A13125
Roles:
- Ref: stacknamemyroleconstructIAMRole4AA71546
Metadata:
aws:cdk:path: stack-name/root-construct/my-role-construct/IAMRole/DefaultPolicy/Resource
```

### Proposed Solution

Just make the[ private defaultPolicy field](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-iam/lib/role.ts#L400) public. It's my template, darn it! :)

### Other Information

Open to other work-arounds.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.89.0

### Environment details (OS name and version, etc.)

All

Start in packages/aws-cdk-lib/aws-iam/lib/role.ts at the private defaultPolicy field linked in the issue, and inspect how IAM.Role exposes related constructs. Make the defaultPolicy accessible as proposed, then verify that consumers can reach the generated AWS::IAM::Policy and apply the requested CloudFormation metadata.

Written by the indexing model from the issue text.