(aws_cognito): Support Custom Attributes in Access Tokens

### Describe the feature

I don't know if this is the right place for this. However, we use OAuth2 with our APIs to secure them with the authorization grant and client credentials flows.

One use case for this is allowing users to access our core APIs from their third-party applications directly. Currently, we use Auth0 to do this because they enable us to put the user's ID and organization ID in as custom claims and pass that info along with the access token, which gives us a complete picture of who is using the API (via a combo of user ID, organization ID, and scopes).

We've done a lot of research on this to make it work, to no avail. We would love to use Cognito via CDK, but this limitation is showstopping.

### Use Case

We need this to get the complete picture of who is accessing our API with the following attributes:
- Custom User ID
- Custom Organization ID
- List of Scopes

### Proposed Solution

Using the post login hook for Cognito, allow a user to add custom claims to that authorization token before it is created. This is the same way that Auth0 does it.

### Other Information

_No response_

### Acknowledgements

- [X] I may be able to implement this feature request
- [X] This feature might incur a breaking change

### CDK version used

^2.97.1

### Environment details (OS name and version, etc.)

MacOS Latest Version

Start by reviewing the aws_cognito implementation and its support for Cognito authorization tokens and post-login hooks. The work is complete when custom user ID and organization ID claims can be added to access tokens while preserving the requested scopes, with coverage for the supported configuration.

Written by the indexing model from the issue text.