(docdb): Updating secret name or switching from an auto-generated secret to an imported one requires cluster replacement even though it could be updated without replacement

### Describe the bug

When updating the `masterUser.secretName` field of `docdb.DatabaseCluster`, or switching from an auto-generated secret without `masterUser.password` to importing one via `masterUser.password`, the cluster needs to be replaced on deploy. This is because the MasterUsername field in the CFN changes, since it references a secret value. However, the construct already knows the username from the `masterUser.username` prop, so this replacement could be avoided by just setting MasterUsername directly as a string rather than a secret value lookup.

### Expected Behavior

Updating `masterUser.secretName` on a `docdb.DatabaseCluster` or adding `masterUser.password` should not require replacement of the cluster.

### Current Behavior

Updating `masterUser.secretName` on a `docdb.DatabaseCluster` or adding `masterUser.password` requires replacement of the cluster.

### Reproduction Steps

1. Create a DocDB cluster and deploy
2. Change the secretName and deploy again
4. Observe that a CFN replacement of the cluster is triggered

### Possible Solution

This issue could be fixed by changing [this line](https://github.com/aws/aws-cdk/blob/6b41c8bf784cb2e8a77ee556fff5910277d3f458/packages/aws-cdk-lib/aws-docdb/lib/cluster.ts#L497):
```diff
- masterUsername: secret ? secret.secretValueFromJson('username').unsafeUnwrap() : props.masterUser.username,
+ masterUsername: props.masterUser.username,
```
This would mean that even if the secret name is changed or a custom secret is used, the value for the CFN MasterUsername field would remain the same as long as `masterUser.username` remains the same, meaning no replacement would be required.

Unfortunately, this would be a breaking change as it would change the value of the MasterUsername field for existing clusters from the secret lookup to the string value, meaning existing clusters would require replacement after upgrading the CDK version. Because of this, it may only be able to be implemented in a DatabaseClusterV2 construct, but this issue should be kept in mind if such a construct is ever developed.

### Additional Information/Context

_No response_

### CDK CLI Version

2.115.0

### Framework Version

_No response_

### Node.js Version

20.11.1

### OS

Windows 10 Enterprise

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start in packages/aws-cdk-lib/aws-docdb/lib/cluster.ts at the MasterUsername assignment around line 497, and inspect how secret-based and explicit master user values are synthesized. Determine a backward-compatible approach that avoids replacement when the secret changes or a password is added, while accounting for the existing cluster behavior and the possible need for a DatabaseClusterV2 construct.

Written by the indexing model from the issue text.