aws-cognito: can't set custom attribute as non-writable

### Describe the bug

I have a user pool with a single mutable custom attribute named `custom:tier`. I'd like to mark it as non writable by my client however specifying `writeAttributes` when adding the client to the pool with the code below leaves all attributes (both custom and standard) as writable other than email_verified and phone_number_verified.

```
writeAttributes: new cognito.ClientAttributes()
.withStandardAttributes({
emailVerified: false,
phoneNumberVerified: false,
})
.withCustomAttributes()
```

If I update this to include my custom attribute in the `withCustomAttributes` it marks all the standard attributes as non-writable. Similarly, if I include a standard attribute as writable like `email: true` it marks email writable as expected and marks everything else as non-writable. It appears the writeAttributes requires at least one attribute to be writable in order to mark the rest as non-writable.

### Expected Behavior

I would expect for the attributes specified to `writeAttributes` to be the only ones that are writable and everything else to be non-writable.

### Current Behavior

If I specify standard attributes as non-writable, it leaves my custom attributes writable and there doesn't appear to be any way to mark them non-writable.

### Reproduction Steps

```
interface Props extends cdk.StackProps {}

export class TestStack extends cdk.Stack {
constructor(scope: Construct, id: string, props: Props) {
super(scope, id, props);

const userPool = new cognito.UserPool(this, 'UserPool', {
userPoolName: 'TestPool',
signInCaseSensitive: false,
selfSignUpEnabled: true,
userVerification: {
emailSubject: 'Verify your email',
emailBody: 'Thanks for signing up! Your verification code is {####}',
emailStyle: cognito.VerificationEmailStyle.CODE,
},
signInAliases: {
email: true,
},
accountRecovery: cognito.AccountRecovery.EMAIL_ONLY,
advancedSecurityMode: cognito.AdvancedSecurityMode.AUDIT,
customAttributes: {
tier: new cognito.NumberAttribute({ mutable: true }),
},
});

const client = userPool.addClient('AppClient', {
preventUserExistenceErrors: true,
readAttributes: new cognito.ClientAttributes()
.withStandardAttributes({
email: true,
emailVerified: true,
phoneNumberVerified: true,
})
writeAttributes: new cognito.ClientAttributes()
.withStandardAttributes({
emailVerified: false,
phoneNumberVerified: false,
})
.withCustomAttributes()
}),
});
}
}
```

Deploying the above stack will result in the client's attributes settings looking like this:

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.146.0 (build b368c78)

### Framework Version

2.147.0

### Node.js Version

v22.3.0

### OS

MacOS

### Language

TypeScript

### Language Version

~4.9.5

### Other information

_No response_

Start by reproducing the stack using UserPool.addClient, ClientAttributes.withStandardAttributes, and withCustomAttributes, then inspect how writeAttributes is translated for Cognito clients. Done means a client can make custom:tier non-writable while retaining the requested standard-attribute permissions, with coverage for the reported configuration.

Written by the indexing model from the issue text.