(aws_cloudwatch_actions): SsmIncidentAction does not work with cross account response plans

### Describe the bug

Cross account response plans do not work with SsmIncidentAction.
`
alarm.add_alarm_action(SsmIncidentAction(cross_account_response_plan))
`

This could also be considered a missing "Feature", but cross account is fundamental to AWS incident manager, it is table stakes.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

Cross account response plans are supported and the method detects if it is an ARN or a name (or has multiple inputs).

### Current Behavior

The method always generates an ARN with the current environment account. If a cross account ARN is passed in right now, it is just treated as the name and gets a new ARN on the front with the local account (double ARN'ed).

### Reproduction Steps

The issue is clear from the code:
https://github.com/aws/aws-cdk/blob/8b23b5db3668c5c5b845e06397bf0001a55f5d0e/packages/aws-cdk-lib/aws-cloudwatch-actions/lib/ssm.ts#L80-L92

No way to override any ARN attributes.

### Possible Solution

There is an easy workaround using escape hatches, eg:
`
alarm.node.default_child.add_property_override("AlarmActions", [cross_account_response_plan])
`

### Additional Information/Context

_No response_

### CDK CLI Version

2.1000.2

### Framework Version

2.184.1

### Node.js Version

v22.13.1

### OS

Mac

### Language

Python

### Language Version

3.12

### Other information

_No response_

Start in packages/aws-cdk-lib/aws-cloudwatch-actions/lib/ssm.ts at lines 80-92, where SsmIncidentAction builds the alarm action ARN. Check how the input is handled for names versus existing ARNs; done means a cross-account ARN is preserved without adding the current account, while name inputs retain their expected behavior.

Written by the indexing model from the issue text.