MachineImage: resolveSsmParameterAtLaunch fails CloudFormation

### Describe the bug

`MachineImage.resolveSsmParameterAtLaunch("...")` does not produce the correct `imageId` string required by CloudFormation.

As can be seen here:
https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-ec2/lib/machine-image/machine-image.ts#L259

The string produced is `resolve:ssm:${this.parameterName}${versionString}` when the CloudFormation documentation states it should be `{{resolve:ssm:${this.parameterName}${versionString}}}` instead (two extra open and close braces at start and end).

CloudFormation Documentation on dynamic SSM parameter references:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html

### Expected Behavior

The `imageId` value is produced with the correct syntax and CloudFormation is able to successfully process the value.

### Current Behavior

CloudFormation currently fails with the following error message:

```
Resource handler returned message: "Unsupported data type. The following parameter data types are supported: aws:ec2:image (Service: AmazonEC2; Status Code: 400; Error Code: SsmInvalidParameter; Request ID: b045aa93-4c28-40b6-80da-c654e4daab78; Proxy: null)" (RequestToken: 5d1c2355-257a-79a1-bc99-d9ac75740c23, HandlerErrorCode: GeneralServiceException)
```

### Reproduction Steps

Use `MachineImage.resolveSsmParameterAtLaunch("any-ssm-parameter-name")` in a LaunchTemplate for an ASG.

### Possible Solution

Current workaround is to use `MachineImage.fromSsmParameter("any-ssm-parameter-name")`.

### Additional Information/Context

_No response_

### CDK CLI Version

2.90.0

### Framework Version

_No response_

### Node.js Version

18.17.1

### OS

Mac M1

### Language

Python

### Language Version

3.10.11

### Other information

_No response_

Start in packages/aws-cdk-lib/aws-ec2/lib/machine-image/machine-image.ts at the referenced imageId construction, then trace the resolveSsmParameterAtLaunch entry point through LaunchTemplate or ASG synthesis. Reproduce the issue with an SSM parameter and verify the synthesized imageId uses CloudFormation’s dynamic-reference syntax and is accepted by CloudFormation.

Written by the indexing model from the issue text.