aws_cloudfront: default S3 bucket for logging does not enable ACL access

### Describe the bug

When providing a logging configuration for a CloudFrontWebDistribution, it is optional to specify an S3 bucket - when not specified, one will be created by default. However, the [default S3 bucket configuration](https://github.com/aws/aws-cdk/blob/c445b8cc6e20d17e4a536f17262646b291a0fe36/packages/aws-cdk-lib/aws-cloudfront/lib/web-distribution.ts#L962) gives the error "The S3 bucket that you specified for CloudFront logs does not enable ACL access". This means that the default S3 bucket configuration is broken.

### Expected Behavior

I expected the default S3 bucket configuration to be suitable for CloudFrontWebDistribution logs and for no error to be produced.

### Current Behavior

Relying on the default S3 bucket configuration gives the error "The S3 bucket that you specified for CloudFront logs does not enable ACL access".

### Reproduction Steps

```
source_s3_bucket = s3.Bucket(...)

cloudfront.CloudFrontWebDistribution(
self, "CloudFront",
origin_configs=[
cloudfront.SourceConfiguration(
s3_origin_source=cloudfront.S3OriginConfig(
s3_bucket_source=source_s3_bucket
),
behaviors=[cloudfront.Behavior(is_default_behavior=True)]
)
],
viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
enabled=True,
logging_config=cloudfront.LoggingConfiguration(
# no bucket specified so cdk will create one by default
include_cookies=False,
),
)
```

### Possible Solution

According to https://github.com/aws/aws-cdk/issues/25358 the S3 bucket defaults were updated in April 2023 - this may be the cause of the problem.

To resolve the problem, the default S3 bucket configuration at https://github.com/aws/aws-cdk/blob/c445b8cc6e20d17e4a536f17262646b291a0fe36/packages/aws-cdk-lib/aws-cloudfront/lib/web-distribution.ts#L962 must be updated to enable ACL access, as required by CloudFrontWebDistribution. In my own code, I create an S3 bucket manually and specify
```
cloudfront_logs_bucket = s3.Bucket(
self, "LogsBucket",
access_control=s3.BucketAccessControl.LOG_DELIVERY_WRITE,
....
)
```

### Additional Information/Context

_No response_

### CDK CLI Version

2.101.0 (build cbaa50e)

### Framework Version

Python package: aws-cdk-lib==2.101.0

### Node.js Version

v18.18.2

### OS

Debian Linux

### Language

TypeScript, Python

### Language Version

_No response_

### Other information

_No response_

Start in packages/aws-cdk-lib/aws-cloudfront/lib/web-distribution.ts at the default S3 bucket configuration linked in the issue, then reproduce the CloudFrontWebDistribution logging setup without specifying a bucket. Done means the generated default bucket supports the ACL access required by CloudFront logs and the reported error no longer occurs.

Written by the indexing model from the issue text.