Secrets Manager: raises a security issue when adding rotationLambda

### Describe the bug

The following cloudformation guard rule fails https://docs.aws.amazon.com/controltower/latest/userguide/lambda-rules.html#ct-lambda-pr-2-description

This is due to the fact that it is missing a SourceAccount in the service principal

A resource policy for rotation lambda is created here and this causes the cfn guard rule to fail.

https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-secretsmanager/lib/rotation-schedule.ts#L107

### Expected Behavior

I should be allowed to add or override the service principal created [here](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-secretsmanager/lib/rotation-schedule.ts#L107
), to address cfn guard rule failing

### Current Behavior

I have no way to address the cloudformation guard [rule](https://docs.aws.amazon.com/controltower/latest/userguide/lambda-rules.html#ct-lambda-pr-2-description), created due to this [line](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-secretsmanager/lib/rotation-schedule.ts#L107)

### Reproduction Steps

add a rotation lambda to secrets manager, and run [cdk cfn guard validator](https://github.com/cdklabs/cdk-validator-cfnguard)

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.104.0

### Framework Version

_No response_

### Node.js Version

v16.20.0

### OS

mac

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start in packages/aws-cdk-lib/aws-secretsmanager/lib/rotation-schedule.ts around line 107 and reproduce the issue by adding a rotation Lambda, then running the cdk cfn guard validator. Determine how the service principal can be overridden or supplied with a SourceAccount, and verify that the generated resource policy satisfies the referenced guard rule.

Written by the indexing model from the issue text.