Cognito: Cannot create cfn user pool with only email MFA enabled

### Describe the bug

Trying to create a Cognito user pool using the L1 construct and ONLY email MFA enabled leads to an error in CloudFormation.

This DOES work if I create the same user pool without any MFA enabled and then go to the AWS console and update it manually to have email only MFA.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

CloudFormation is able to create the requested resource without issues.

### Current Behavior

Error in CloudFormation with this message:
```
Resource handler returned message: "SMS configuration and Auto verification for phone_number are required when MFA is required/optional (Service: CognitoIdentityProvider, Status Code: 400, Request ID: ..., HandlerErrorCode: InvalidRequest)
```

### Reproduction Steps

Here is an example of a stack that yields the error in CloudFormation

```
import * as cognito from 'aws-cdk-lib/aws-cognito';
import { App, Stack, StackProps } from 'aws-cdk-lib/core';

export class AuthStack extends Stack {
constructor(scope: App, id: string, props: StackProps) {
super(scope, id, props);

const userPool = new cognito.CfnUserPool(this, 'UserPool', {
userPoolName: 'UserPool123',
adminCreateUserConfig: {
allowAdminCreateUserOnly: true,
unusedAccountValidityDays: 1,
},
usernameAttributes: ['email'],
usernameConfiguration: {
caseSensitive: false,
},
enabledMfas: ['EMAIL_OTP'],
mfaConfiguration: 'OPTIONAL',
});
}
}
```

### Possible Solution

_No response_

### Additional Information/Context

Very similar bug, but with OTP only MFA enabled https://github.com/aws/aws-cdk/issues/11478

### CDK CLI Version

2.173.2

### Framework Version

_No response_

### Node.js Version

v18.19.1

### OS

Mac OS

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start with the TypeScript CfnUserPool reproduction in the issue and compare it with the linked OTP-only MFA issue. Done means CloudFormation can create a user pool with only EMAIL_OTP enabled without requiring SMS configuration or phone-number auto verification.

Written by the indexing model from the issue text.