aws_opensearchservice: Grant permissions using access policy for principals that cannot have policies attached

### Describe the feature

We would like to be able to grant access to principals that cannot have policies attached by using the accesspolicies on OpenSearch

The current OpenSearch grantXYZ methods only works for adding permissions to a principal and not to add permissions to the access policy.

### Use Case

We want to grant cross-account access to OpenSearch and want to use the Role.FromRoleArn in our stack and then use grantIndexWrite method to grant those principals access.

### Proposed Solution

Use the access policy (resource policy) if the principal does not allow adding permissions (like an imported role or AccountPrincipal or similar)

### Other Information

We can manually craft the access policy using the [addAccessPolicies ](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_opensearchservice.Domain.html#addwbraccesswbrpoliciesaccesspolicystatements), but it's much more convenient and easier to understand if we can use the grantXYX methods.

More about OpenSearch Domain Access Policies (Resource Policies):
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html#ac-types-resource
### Acknowledgements

- [X] I may be able to implement this feature request
- [X] This feature might incur a breaking change

### CDK version used

2.129.0

### Environment details (OS name and version, etc.)

Windows 11

Start at the aws_opensearchservice Domain grantXYZ methods and the addAccessPolicies entry point mentioned in the issue. Review how imported roles, AccountPrincipal, and other principals handle permissions, then define done as grant methods applying the OpenSearch access policy when identity policies cannot be attached, with coverage for the cross-account case.

Written by the indexing model from the issue text.