aws-logs: add `AccountPolicy` L2 construct

### Describe the feature

The L2 construct equivalent of [`CfnAccountPolicy`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_logs.CfnAccountPolicy.html), aimed at reducing boilerplate code and simplifying configuration; it should help to prevent common pitfalls (see #31266).

### Use Case

See above.

### Proposed Solution

The `AccountPolicy` construct should accept an input of type `AccountPolicyType`, an enum with the following possible values:

- `LAMBDA`
- `KINESIS_DATA_STREAM`
- `DATA_FIREHOSE`

Depending on the selected `AccountPolicyType`, you’ll need to provide a different kind of `target`. For example, if `LAMBDA` is specified, you must provide an `IFunction`. The required permissions for the target resource will be automatically attached when the `AccountPolicy` is created.

### Other Information

Creating an [account-level subscription filter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters-AccountLevel.html) involves 4 steps:

1. Create the target resource for the subscription filter (Lambda, Kinesis Data Stream, or Data Firehose).
2. Grant CloudWatch Logs permission to use the target resource.
3. Add a dependency in the CDK resource graph to ensure the subscription filter is not created before the permission is granted.
4. Create the account-level subscription filter.

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.189.0

### Environment details (OS name and version, etc.)

Ubuntu 24.04

Start with the linked CfnAccountPolicy documentation and issue #31266 to understand the account-level subscription-filter requirements and common pitfalls. Define the AccountPolicyType and target combinations for Lambda, Kinesis Data Stream, and Data Firehose, then verify that permissions, resource dependencies, and account-level filter creation are all covered.

Written by the indexing model from the issue text.