(rds): Encrypt DatabaseCluster (aurora) or DatabaseInstance (rds) storage with AWS-managed key by default (behind feature flag)

### Describe the feature

If the user doesn't customize the `DatabaseCluster` or `DatabaseInstance` `storageEncrypted` property and does not pass a custom `storageEncryptionKey`, we should default the value to `true`. This will cause the AWS-managed `aws/rds` KMS key to be used.

Notes:
- Since this is a breaking change for existing users, we should guard the feature behind a feature flag.
- We should also add an acknowledgable warning annotation to warn people that don't specify `storageEncrypted` or `storageEncryptionKey` (as they would be affected by this change in v3).

### Use Case

Today, if you don't remember to pass `storageEncrypted: true` to your `DatabaseInstance` or `DatabaseCluster`, your database's storage will be unencrypted.

In almost all cases, your database storage should be encrypted. Here are reasons I think we should use AWS-managed keys by default:

- AWS Well-Architected security pillar says all data should be encrypted at rest.
- There is no additional fee to use the AWS-managed KMS key
- When creating RDS instances and clusters via the AWS Console UI, encryption with AWS-managed keys is enabled by default.
- Adding encryption to a previously unencrypted database is [an involved process](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/encrypt-an-existing-amazon-rds-for-postgresql-db-instance.html) that requires recreating your database from a snapshot. Applying encryption to an unencrypted database is time-consuming and a bad developer and user experience.
- Other L2 constructs apply encryption by default, including [Neptune](https://github.com/aws/aws-cdk/blob/aed8ad10c3d86497be34b2889466f770910d36ef/packages/@aws-cdk/aws-neptune-alpha/lib/cluster.ts#L623-L624) and [DocDb](https://github.com/aws/aws-cdk/blob/aed8ad10c3d86497be34b2889466f770910d36ef/packages/aws-cdk-lib/aws-docdb/lib/cluster.ts#L526-L527)
- If you don't encrypt your storage, you'll see warnings in the RDS UI telling you that your storage is unencrypted.
- Users can easily retain the existing behavior by simply passing `storageEncrypted: false`.

### Proposed Solution

This applies to `DatabaseCluster` and `DatabaseInstance`.

If:
- `storageEncrypted` is not specified in the props; and,
- `storageEncryptionKey` is not specified in the props

Then:
- If the feature flag is set to `true`, default `storageEncrypted` to `true`
- If the feature flag is set to `false`, leave `storageEncrypted` `undefined` (existing logic).
- Add a warning annotation that the user should explicitly set `storageEncrypted` to `false` to retain compatibility with the new behavior.

### Other Information

_No response_

### Acknowledgements

- [X] I may be able to implement this feature request
- [X] This feature might incur a breaking change

### CDK version used

2.171.1

### Environment details (OS name and version, etc.)

MacOS