[aws-secretsmanager]: Expose arnForPolicies on ISecret

### Describe the feature

The property arnForPolicies is currently defined protected on SecretBase and used by the grantRead and grantWrite methods. Making this a public property on ISecret simplifies creation of custom policies.

### Use Case

The Kubernetes External Secrets operator needs additional actions granted on secrets used, as described [here](https://external-secrets.io/v0.5.1/provider-aws-secrets-manager/#iam-policy). These are not added when simply using ISecret.grantRead.

However, using the correct ARN for secrets in policies is non-trivial, especially when you aren't sure at the time of writing where the secret in question will come from. CDK internally uses a mechanism to resolve this, but it is not exposed.

Another usecase would be to handle multiple secret resources inside a single policy statement.

### Proposed Solution

The logic is already present, it just needs to be made public.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.99.0

### Environment details (OS name and version, etc.)

Windows 10

Start by reading the SecretBase and ISecret definitions, then follow how grantRead and grantWrite use arnForPolicies. The logic is already present; done means exposing the property on ISecret so callers can use the correct ARN when creating custom policies, with the relevant existing tests updated or extended if present.

Written by the indexing model from the issue text.