(aws-cdk-lib/aws-certificatemanager): Support cross-account CertificateValidation

### Describe the feature

After CDK moved from the custom-lambda function to the R53 Cfn L1 constructs for RecordChangeSets, we've lost the ability to support cross-account Hosted Zones.

Ideally, I should be able to attach a policy to my HostedZone which grants permissions to the other account

### Use Case

Example construct:
```ts
import {
Certificate,
CertificateValidation,
} from "aws-cdk-lib/aws-certificatemanager";

...

// Created in Account B
new Certificate(
this,
"bar.foo.com",
{
domainName: "bar.foo.com",
validation: CertificateValidation.fromDnsMultiZone({
"bar.foo.com": this.hostedZoneId,
"foo.com": "Z111444", // Zone ID from Account A
}),
subjectAlternativeNames: [ "foo.com" ],
}
);
...
```

Error from Cloudformation:
```text
API: certificatemanager:changeResourceRecordSets User: arn:aws:sts::999999999999:assumed-role/MyCoolExecutionRole/AWSCloudFormation is not authorized to access this resource
```


### Proposed Solution

in absence of the HostedZone resource policy, I propose we support an optional, custom IAM Role input on the `CertificateValidation.fromDNS*` methods. If provided, the construct would create a `CustomResoruce` using that provided IAM Role.

For my particular use case, this means the Custom Resource in account B would assume the Delegation Role I've created in Account A.


### Other Information

_No response_

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.95.0

### Environment details (OS name and version, etc.)

Amazon Linux release 2 (Karoo) / 5.4.254

Start at CertificateValidation.fromDnsMultiZone and the other fromDNS* entry points described in the issue, then trace how DNS validation currently updates Route 53 records and handles IAM. Done means an optional role supports validation against a hosted zone in another account, with coverage for the cross-account multi-zone example and the existing behavior preserved.

Written by the indexing model from the issue text.