sns: Lambda Event Source for Opt In Regions Fail

### Describe the bug
[Updated as the behavior has changed since opening the issue]

Leveraging `addEventSource(new SnsEventSource(testTopic)` on a Lambda in a non opt in account when the topic is in an opt-in region ~~fails to create due to a 403 expired token access~~ creates and deploys as expected but is unable to be triggered by messages published to the topic.

### Expected Behavior

~~I expect the addEvent source to add the cross region topic from the opt-in account just as it would for an opt in account.~~

I expect the consuming lambda to be triggered by messages published to the opt in region's topic.

### Current Behavior

~~The cdk deploy fails to create the eventSource with a 403 expired token error~~

The Function is deployed without error and the console reflects the subscription and trigger but the function fails to trigger when a message is posted to the topic.

### Reproduction Steps [UPDATED]

[The lambda and the topic are in different cdk apps. Or the topic can be created in any mechanism.]

1. Create a Lambda in us-east-1 (any not opt in region)
2. Create a topic in me-central-1 (any opt in region)
3. Through the cdk add `lambdaFunction.addEventSource(new SnsEventSource(testTopic));`
4. cdk deploy
5. Send a message to the topic
6. Observe the lambda did not run

### Possible Solution

Update https://github.com/aws/aws-cdk/blob/6fdc4582f659549021a64a4d676fce12fc241715/packages/aws-cdk-lib/aws-sns-subscriptions/lib/lambda.ts#L33
to check if the account is opt-in and if so add the region to the principal
```
principal: new iam.ServicePrincipal('sns.${optInTopicRegion}.amazonaws.com'),
```

### Additional Information/Context

This stemmed from a support case from aws and they are looking into it but not sure when they would get to it.

### CDK CLI Version

2.141.0

### Framework Version

_No response_

### Node.js Version

18.20.2

### OS

MacOS

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start in packages/aws-cdk-lib/aws-sns-subscriptions/lib/lambda.ts, especially the service-principal configuration referenced by the issue. Reproduce the setup with the Lambda in a non-opt-in region and the SNS topic in an opt-in region, then verify that publishing to the topic triggers the Lambda. Done means the cross-region subscription both deploys and invokes the function successfully.

Written by the indexing model from the issue text.