WAF ACL: no way to add association for existing CloudFront distribution

### Describe the feature

Add controls to either WAF V2 class or CloudFront Distribution class to be able to setup association for an existing CloudFront distribution. Currently only CloudFront distribution constructor accepts `webAclId`. There is no way to add `webAclId` if `fromDistributionAttributes` has been used to import existing distribution.

### Use Case

There is an existing CloudFront distribution with a CNAME attached. A new separate CDK template is created with WAF web ACL. I want to establish an association between the ACL and an existing CloudFront distribution that's been imported into the current template via `fromDistributionAttributes` call.

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.114.1

### Environment details (OS name and version, etc.)

ManjaroLinux 23.1.4

Start by reading the WAF V2 and CloudFront Distribution entry points, especially the fromDistributionAttributes import path and the existing webAclId handling. Determine where an imported distribution can receive an ACL association, then add coverage showing an existing CloudFront distribution can be associated with a WAF web ACL without recreating it.

Written by the indexing model from the issue text.