(custom-resource): Creation Fails Due to Lack of Permissions on Some Services

### Describe the bug

When using the custom-resource (AwsCustomResource) module there are arbitrary failures on AWS services. This seems to be because the Custom Resource that is created has a policy associated to the lambda function and immediately executes it. The execution is not timed to wait until permissions are attached or validated. Even when using a CloudFormation Wait Condition the resources are created simultaneously.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

When using AwsCustomResource and defining the policy the custom resource should wait until policy creation before execution.

### Current Behavior

When calling AwsCustomResource and defining the policy for the resource the policy is immediately created along with execution of the lambda function. If the policy creation is not completed or delayed due to some sort of inconsistent latency within AWS the custom resource lambda fails with permission denied.

### Reproduction Steps

Create a CDK deployment that creates a Custom Resource using the below policy and Custom Resource.

Policy

```ts
const putAccountContactInformationPolicy = cr.AwsCustomResourcePolicy.fromStatements([
new iam.PolicyStatement({
actions: [
'account:GetAccountInformation',
'account:PutContactInformation',
],
resources: [`arn:aws:account::${Aws.ACCOUNT_ID}:account`],
}),
]);
```

Custom Resource

```ts
new cr.AwsCustomResource(this, 'PutContactInformation', {
onUpdate: {
service: '@aws-sdk/client-account',
action: 'PutContactInformationCommand',
parameters: {
ContactInformation: {
FullName: 'redacted',
AddressLine1: 'redacted',
City: 'redacted',
StateOrRegion: 'redacted',
PostalCode: 'redacted',
CountryCode: 'redacted,
PhoneNumber: 'redacted',
CompanyName: 'redacted,
WebsiteUrl: 'redacted,
},
AccountId: Aws.ACCOUNT_ID,
},
physicalResourceId: cr.PhysicalResourceId.of(Date.now().toString()),
},
policy: putAccountContactInformationPolicy,
});
```

### Possible Solution

Decouple creation of the policy for the custom resource from the same call. Allow creation of a depends on for the policy for the custom resource.

### Additional Information/Context

See related issue that was closed: [21332](https://github.com/aws/aws-cdk/issues/21332)

### CDK CLI Version

2.147.3 (build 32f0fdb)

### Framework Version

_No response_

### Node.js Version

v18.20.4

### OS

MacOSX

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start at the AwsCustomResource entry point and reproduce the deployment using the account policy and PutContactInformation example in the issue. Trace how the policy and custom-resource Lambda are created, then verify that the policy is ready before invocation and that the deployment no longer fails with permission denied.

Written by the indexing model from the issue text.