aws_cloudfront: add support for one-click security protections to `Distribution`

### Describe the feature

Add support for WAF [one-click security protections](https://aws.amazon.com/about-aws/whats-new/2023/05/amazon-cloudfront-one-click-security-protections/) to `Distribution` L2 construct.

### Use Case

When managing a distribution from the CloudFront console, users have the option to enable WAF Core Protections. This feature simplifies the process of adding security protections to CloudFront distributions. I would like to have a similar feature in the CDK to allow users to easily enable these protections when defining their infrastructure as code.

## Current Behavior in CloudFront Console

When enabling WAF Core Protections in the CloudFront console:

1. A Web ACL named `CreatedByCloudFront-` is created in the AWS account.

2. The created Web ACL is attached to the CloudFront distribution through the `webAclId` property.

3. When disabling the WAF Core Protections, the CloudFront console seamlessly detaches the Web ACL and deletes it from the AWS account.




### Proposed Solution

- Introduce a new property called `enableWafCoreProtections` to the `Distribution` construct, similar to existing properties like `enableLogging` and `enableIpv6`.

- When `enableWafCoreProtections` is set to `true`:
- Create a Web ACL with a name following the pattern `CreatedByCloudFront-`.
- Attach the created Web ACL to the CloudFront distribution.

- When `enableWafCoreProtections` is set to `false` or not specified:
- Do not create or attach a Web ACL.

- Implement logic to prevent the use of `webAclId` when `enableWafCoreProtections` is set to `true` to avoid conflicts.

## Example Usage

```typescript
new cloudfront.Distribution(this, 'MyDistribution', {
// ... other properties ...
enableWafCoreProtections: true,
});
```

### Other Information

## Additional Considerations

- Consider adding a way to retrieve the ID of the created Web ACL for reference in other parts of the CDK app if needed.
- Implement proper error handling and validation to ensure that `enableWafCoreProtections` and `webAclId` are not used together.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.162.0

### Environment details (OS name and version, etc.)

Ubuntu 24.04

Start at the CloudFront Distribution L2 construct and read the existing enableLogging, enableIpv6, and webAclId properties. Trace how a Web ACL could be created and attached when enableWafCoreProtections is enabled, including the conflict validation and any way to expose its ID. Done means the requested option works, the generated ACL follows the stated naming behavior, and disabling or omitting it creates no ACL.

Written by the indexing model from the issue text.