aws-cdk/aws-cognito-identitypool-alpha: allow session tagging

### Describe the feature

Allow IAM roles created by Identity Pool CDK construct to tag sessions for federated identities.

### Use Case

We are using a Cognito Identity Pool to assign AWS credentials for federated identities, and we need to tag sessions for the IAM policies to work. Unfortunately, it seems to be impossible to create Identity Pool and its authenticated role in such a way that it is allowed to tag sessions. The approach introduced in https://github.com/aws/aws-cdk/issues/15908 (calling `.withSessionTags()` on the principal before passing it into the newly created IAM role) seemingly cannot be used with Identity Pool CDK construct, because the identity pool does not exist at the time authenticated role is created, and it looks impossible to change trust policy on the IAM role created by Identity Pool CDK construct itself.

### Proposed Solution

It would be great if there was a flag in the Identity Pool CDK construct allowing the authenticated role to tag created sessions. Probably all it needs to do is to call `.withSessionTags()` on the identity pool principal when the role is being created.

### Other Information

As a workaround, we have to manually add `sts:TagSessions` action to the trust policy of the authenticated role.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.130 (python)

### Environment details (OS name and version, etc.)

Linux 6.6.30-0-virt 1-Alpine SMP aarch64 GNU/Linux

Start with the aws-cdk/aws-cognito-identitypool-alpha Identity Pool CDK construct and read how its authenticated IAM role is created. Compare that principal setup with the .withSessionTags() approach described in the issue. Done means the construct offers a way to allow session tagging without the manual sts:TagSessions trust-policy workaround.

Written by the indexing model from the issue text.