(BucketDeployment): Generates IAM policy not approved by CDK Nag

### Describe the bug

Using the `BucketDeployment` construct generates an IAM policy which is not approved by CDK Nag tool.

### Expected Behavior

Compliant policy should be generated by default or alternatively explain the reasoning in the documentation and document steps to suppress the warning.

### Current Behavior

```
[Error at /stack/Custom::CDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756C/ServiceRole/Resource] AwsSolutions-IAM4[Policy::arn::iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]: The IAM user, role, or group uses AWS managed policies. An AWS managed policy is a standalone policy that is created and administered by AWS. Currently, many AWS managed policies do not restrict resource scope. Replace AWS managed policies with system specific (customer) managed policies.This is a granular rule that returns individual findings that can be suppressed with 'appliesTo'. The findings are in the format 'Policy::' for AWS managed policies. Example: appliesTo: ['Policy::arn::iam::aws:policy/foo'].
```

### Reproduction Steps

```ts

new s3deploy.BucketDeployment(this, 'IncomingData', {
destinationBucket: bucket,
sources: [s3deploy.Source.asset('./example-data')],
retainOnDelete: false,
});
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.96.2

### Framework Version

_No response_

### Node.js Version

18

### OS

all

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Start with the BucketDeployment construct and the provided TypeScript reproduction, then inspect the generated ServiceRole policy reported by CDK Nag. Confirm whether the default policy can be made compliant; otherwise, document the suppression steps and reasoning. Done means the reproduction no longer produces an unaddressed AwsSolutions-IAM4 finding or clearly documents how to suppress it.

Written by the indexing model from the issue text.