cloudfront_origins: Built-in lookup for CloudFront VPC origin security group?

### Describe the feature

It could really help with my user code readability if the [pattern mentioned here](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront_origins-readme.html#the-vpc-origin-service-security-group) for looking up the ID of CloudFront's VPC Security Group, could be embedded directly into the `VpcOrigin` construct or elsewhere in one of the CloudFront CDK packages?

### Use Case

I'm connecting a CloudFront Distribution to an ALB in my VPC using [CloudFront VPC Origins](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-vpc-origins.html), and trying to grant least-privilege ingress access to the ALB's security group via `SecurityGroup.addIngressRule(...)`: Only allowing connections from the CloudFront service.

It's great that the CDK docs mention a pattern for looking up CloudFront's generated SG with a Custom Resource (since the alternative [EC2 prefix list approach](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront_origins-readme.html#the-cloudfront-managed-prefix-list) requires you to know the prefix list ID for your specific AWS Region)... But would be better if this pattern could be pushed into the library itself to simplify usage?

### Proposed Solution

As I understand (?) the security group is 1/ only generated if/when VPC origin(s) are configured, and 2/ shared between any CloudFront distributions connecting to that VPC.

Some possible places it could be added I can think of include:
- A property on `Distribution` like `vpcOriginSecurityGroupId` (presumably that does a lazy check during synthesis and throws an error if it's referenced when none of the origins in the distribution are VPC Origins?)
- A stand-alone construct/resource in aws-cloudfront-origins that takes a distribution and a VPC as props maybe?

### Other Information

_No response_

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.180.0

### Environment details (OS name and version, etc.)

MacOS 15.3

Start with the CloudFront VPC Origins documentation pattern and the VpcOrigin and Distribution entry points mentioned in the issue. Compare the proposed Distribution property with a stand-alone construct/resource, including how SecurityGroup.addIngressRule(...) would consume the lookup. Done means a supported library API exposes the CloudFront VPC origin security group ID without user-managed lookup code and preserves least-privilege ALB ingress.

Written by the indexing model from the issue text.