aws-cdk-lib: incorrect rendering of CfnParameter in Fn.sub

### Describe the bug

The CloudFormation template generated by `cdk synth` is invalid if `CfnParameter` is in `Fn.sub`.

Similar to #14047 and #14068

### Expected Behavior

The cdk code is valid after `cdk synth` runs

### Current Behavior

```json
"Tags": [
{
"Key": "Environment",
"Value": {
"Fn::Sub": {
"Fn::Join": [
"",
[
"${AWS::StackName}-",
{
"Ref": "Environment"
},
"-foo"
]
]
}
}
}
]
```

```shell
$ cfn-lint cdk.out/HelloWorldStack.template.json
E1019 Sub should be a string or array of 2 items for Resources/helloworldfunctionServiceRole6902C513/Properties/Tags/0/Value/Fn::Sub
cdk.out/HelloWorldStack.template.json:46:8
```

### Reproduction Steps

```typescript
const env = new CfnParameter(this, 'Environment').valueAsString;
Tags.of(this).add('Environment', Fn.sub('${AWS::StackName}-' + env + '-foo'))
```

```shell
$ cdk synth
$ cfn-lint cdk.out/HelloWorldStack.template.json
E1019 Sub should be a string or array of 2 items for Resources/helloworldfunctionServiceRole6902C513/Properties/Tags/0/Value/Fn::Sub
cdk.out/HelloWorldStack.template.json:46:8
```

### Possible Solution

_No response_

### Additional Information/Context

There is no issue if it is in the following format.

```typescript
const env = new CfnParameter(this, 'Environment').valueAsString;
Tags.of(this).add('Environment', Fn.sub('${AWS::StackName}-' + '${env}' + '-foo', {env: env}))
```

```json
"Tags": [
{
"Key": "Environment",
"Value": {
"Fn::Sub": [
"${AWS::StackName}-${env}-foo",
{
"env": {
"Ref": "Environment"
}
}
]
}
}
]
```

### CDK CLI Version

2.113.0 (build ccd534a)

### Framework Version

_No response_

### Node.js Version

v20.0.0

### OS

MacOS

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Reproduce the TypeScript example with cdk synth, then inspect cdk.out/HelloWorldStack.template.json and run cfn-lint to confirm the invalid Fn::Sub shape. Trace the Fn.sub rendering path for CfnParameter values; done means the generated Fn::Sub is a valid string or two-item array and the reproduction passes validation.

Written by the indexing model from the issue text.