(aws-cloudfront): Support TrustedSigners

### Describe the feature

In the CDK there are 2 constructs for CloudFront (`WebDistribution` and `Distribution`). The `WebDistribution` was updated ([ref](https://github.com/aws/aws-cdk/pull/19839)) to support `trustedSigners` along with `trustedKeyGroups`, but the `Distribution` construct only supports `trustedKeyGroups`.

Can we update `Distribution` to add support for `trustedSigners`?

### Use Case

As a developer who maintains a CloudFront distribution in CDK library I need support for `trustedSigners` as the signer will not exist in the account that the CDK constructs are deployed to. The signer will remain a core organization account that has permission to sign the requests.

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.141.0

### Environment details (OS name and version, etc.)

MacOS M1 Pro 13.5.2

Compare the Distribution and WebDistribution constructs, focusing on how WebDistribution added trustedSigners alongside trustedKeyGroups. Start by tracing the Distribution construct's trustedKeyGroups configuration and inspect the linked pull request for the existing behavior. Done means Distribution supports trustedSigners for cross-account CloudFront signers without removing trustedKeyGroups support.

Written by the indexing model from the issue text.